General
- Target 2026-01-10_ffd73f697b6d13c629190672569ce577_conti
- Size 358KB
- Sample260110-dmpsaact2f
- SHA256 9bf7d4ea7392ee39fe577a67c7456fb83eda3e41f4f17c987317dfd784a217b8
Score
10/10
Malware Config
Targets
-
- Target 2026-01-10_ffd73f697b6d13c629190672569ce577_conti
- Size 358KB
- SHA256 9bf7d4ea7392ee39fe577a67c7456fb83eda3e41f4f17c987317dfd784a217b8
Score10/10Babuk Locker
RaaS first seen in 2021 initially called Vasa Locker.
Babuk family
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
Renames multiple (2339) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Credentials from Password Stores: Windows Credential Manager
Suspicious access to Credentials History.
Drops startup file
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1