babuk | 0434726985a08e964c3b9826f52cd50aa33aece7e893f51bacdabdde42dbbc28

General

Target
e_win.exe
Size 79KB
Sample260412-t7p7jsas5m
SHA256 0434726985a08e964c3b9826f52cd50aa33aece7e893f51bacdabdde42dbbc28
MD5 8dee8729eba6cd9df407cf3ed1b221ef
SHA1 b55c26e0f3dff2410fefc6c301dbc955b5294b26
SHA512 1ec140b25a1801229434afe553d7891f74b65ebc1001a16a08c7f9ce758bd877978242c75ff8b02479482887337e8680afbf99fce86033a520101c6b001cc429
SSDEEP 1536:m6UhZM4hubesrQLOJgY8ZZP8LHD4XWaNH71dLdG1iiFM2iG2zs4:ghZ5YesrQLOJgY8Zp8LHD4XWaNH71dLI
TLSH
T17483D8115945E2B6C5D132318167F1AAC13A197003B5B78B63C027AEFB10AE8F6BCF67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  e_win.exe
- Size 79KB
- SHA256 0434726985a08e964c3b9826f52cd50aa33aece7e893f51bacdabdde42dbbc28
- MD5 8dee8729eba6cd9df407cf3ed1b221ef
- SHA1 b55c26e0f3dff2410fefc6c301dbc955b5294b26
- SHA512 1ec140b25a1801229434afe553d7891f74b65ebc1001a16a08c7f9ce758bd877978242c75ff8b02479482887337e8680afbf99fce86033a520101c6b001cc429
- SSDEEP 1536:m6UhZM4hubesrQLOJgY8ZZP8LHD4XWaNH71dLdG1iiFM2iG2zs4:ghZ5YesrQLOJgY8Zp8LHD4XWaNH71dLI
- TLSH
  T17483D8115945E2B6C5D132318167F1AAC13A197003B5B78B63C027AEFB10AE8F6BCF67
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution babuk impact ransomware spyware stealer
- Babuk Locker
  RaaS first seen in 2021 initially called Vasa Locker.
  ransomware babuk
- Babuk family
  babuk
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Renames multiple (123) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2