General
- Target e_win.exe
- Size 79KB
- Sample260302-n2wt9afx4a
- SHA256 da048f23182f24d9fbfb64d0ca28faa4a82f48897de2fb234670ba3817966e43
Score
10/10
Malware Config
Targets
-
- Target e_win.exe
- Size 79KB
- SHA256 da048f23182f24d9fbfb64d0ca28faa4a82f48897de2fb234670ba3817966e43
Score10/10Babuk Locker
RaaS first seen in 2021 initially called Vasa Locker.
Babuk family
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
Renames multiple (130) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Drops desktop.ini file(s)
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1