babuk | 77255c1eef5e764363302a2505bcda6e9ac8d30ac7a0e7e0c62499359b0df2b8

General

Target
e_win.exe
Size 79KB
Sample260331-sk226aew6y
SHA256 77255c1eef5e764363302a2505bcda6e9ac8d30ac7a0e7e0c62499359b0df2b8
MD5 9ed28b4aa6c20eddb1e4dffd77e17418
SHA1 b8b8e8cc5916cf759d412d29fcf99b6da594206d
SHA512 60f0f947265d6ab91f57b1a1c239b1c1d18a1cee6f93d62c42d141b5528a416a2bdd1e7168cddce8bfc5ca5ed02c3c531cc3cf1db92179212a18394954fb8db9
SSDEEP 1536:A6UhZM4hubesrQLOJgY8ZZP8LHD4XWaNH71dLdG1iiFM2iG2zs4:yhZ5YesrQLOJgY8Zp8LHD4XWaNH71dLI
TLSH
T1E383D9115945D2B6C5D132319167F1AAC13A197003B5B78B63C027AEFB10AE8F6BCF67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\How To Restore Your Files.txt

Ransom Note

Greatings! >>>> Your data are stolen and encrypted. Backups are corrupted and wont help you We were able to extract 10TB of you data including: Financials, Trade secrets, Personal info of your cliens and workers, and much much more. The data will be published on TOR and clearnet websites if you do not pay the ransom >>>> What guarantees that we will not deceive you? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. Life is too short to be sad. Dont be sad, money is just paper. If we do not give you decrypters, or we do not delete your data after payment, then nobody will pay us in the future. Therefore to us our reputation is very important. We attack the companies worldwide and there is no dissatisfied victim after payment. >>>> If you wish to contact us and decrypt one file for free - you will have to give us with your personal DECRYPTION ID Write to a chat and wait for the answer, we will always answer you. Sometimes you will need to wait for our answer because we attack many companies. Use session messanger to contact us: Link to download it: https://getsession.org/download Session DecryptSupp: 05c07c4141f2ffd2d62f514d58a610e0d4d29ca267c4cbd12a02f7243a1a9af157 OR Protonmail: [email protected] >>>> Warning! Do not DELETE or MODIFY any files, it will lead to recovery problems! >>>> Warning! If you do not pay the ransom you will not be able to decrypt data, we will leak your data to the public and we will attack your company repeatedly again!"

Emails

[email protected]

URLs

https://getsession.org/download

Targets

- Target
  e_win.exe
- Size 79KB
- SHA256 77255c1eef5e764363302a2505bcda6e9ac8d30ac7a0e7e0c62499359b0df2b8
- MD5 9ed28b4aa6c20eddb1e4dffd77e17418
- SHA1 b8b8e8cc5916cf759d412d29fcf99b6da594206d
- SHA512 60f0f947265d6ab91f57b1a1c239b1c1d18a1cee6f93d62c42d141b5528a416a2bdd1e7168cddce8bfc5ca5ed02c3c531cc3cf1db92179212a18394954fb8db9
- SSDEEP 1536:A6UhZM4hubesrQLOJgY8ZZP8LHD4XWaNH71dLdG1iiFM2iG2zs4:yhZ5YesrQLOJgY8Zp8LHD4XWaNH71dLI
- TLSH
  T1E383D9115945D2B6C5D132319167F1AAC13A197003B5B78B63C027AEFB10AE8F6BCF67
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution babuk impact ransomware
- Babuk Locker
  RaaS first seen in 2021 initially called Vasa Locker.
  ransomware babuk
- Babuk family
  babuk
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Renames multiple (147) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2