babuk | b09a9a58652c62e2dd14ba14f97d4c7213c6472d8f73e587b6d155988af0e8d7

General

Target
2026-01-09_77c73d142a0afee79a61f21e4d818453_conti
Size 359KB
Sample260109-j4shdsew3d
SHA256 b09a9a58652c62e2dd14ba14f97d4c7213c6472d8f73e587b6d155988af0e8d7
MD5 77c73d142a0afee79a61f21e4d818453
SHA1 7869e88562c0da5fa5fa18c581274a3566eeaafe
SHA512 507a92cc97acb5ae6304ffbe3c0ea92be55c65dad8239a18388a201ee5625c43d5ab5af4f3c0119dc8db3d00882a4ba1fa0408fe316d86dffe9a8ac0a66f0234
SSDEEP 3072:esDS1SjUlu7VIDAkwxvhTzZ03m4cWKDfvhFYE6714SjCPVN4Lx6mwDcFWDzHgruT:esWgRTYcWbE6Z4SjqXfHUbd7qyHF1Gln
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  2026-01-09_77c73d142a0afee79a61f21e4d818453_conti
- Size 359KB
- SHA256 b09a9a58652c62e2dd14ba14f97d4c7213c6472d8f73e587b6d155988af0e8d7
- MD5 77c73d142a0afee79a61f21e4d818453
- SHA1 7869e88562c0da5fa5fa18c581274a3566eeaafe
- SHA512 507a92cc97acb5ae6304ffbe3c0ea92be55c65dad8239a18388a201ee5625c43d5ab5af4f3c0119dc8db3d00882a4ba1fa0408fe316d86dffe9a8ac0a66f0234
- SSDEEP 3072:esDS1SjUlu7VIDAkwxvhTzZ03m4cWKDfvhFYE6714SjCPVN4Lx6mwDcFWDzHgruT:esWgRTYcWbE6Z4SjqXfHUbd7qyHF1Gln
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

credential_access defense_evasion discovery execution babuk impact ransomware spyware stealer
- Babuk Locker
  RaaS first seen in 2021 initially called Vasa Locker.
  ransomware babuk
- Babuk family
  babuk
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Renames multiple (2280) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2