General
- Target Babuk Builder.7z
- Size 4.8MB
- Sample260414-s8ab2sfs7q
- SHA256 bced4dc174d5858aa2061ec497d2fbdbb6a705186b2011a146536021c500bed6
Score
10/10
Malware Config
Targets
-
- Target builder.exe
- Size 121KB
- SHA256 4fa565cc2ebfe97b996786facdb454e4328a28792e27e80e8b46fe24b44781af
Score3/10 -
- Target d_esxi.out
- Size 53KB
- SHA256 930760c00de1b9a4bc2eefcd96173f1e9a906b11a9566c517fcb87a13acaa327
Score3/10 -
- Target d_nas_arm.out
- Size 2.0MB
- SHA256 2cd6d4a52dbaf9e79d93492ad73dc229e06d0cee9e3327cc3bef165fae06f918
Score3/10 -
- Target d_nas_x86.out
- Size 1.9MB
- SHA256 51fe57795105eb1e618d35bd99fcc096ee3687455cd4e330396c0d701bc3a6a1
Score3/10 -
- Target d_win.bin
- Size 68KB
- SHA256 eb22f22fedb24ef3d06d2ba6ac9bc53528f8d1e489fefeac9501b926a0be6097
Score7/10-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target e_esxi.out
- Size 69KB
- SHA256 dc90560d7198bf824b65ba2cfbe403d84d38113f41a1aa2f37f8d827fd9e0ceb
Score3/10 -
- Target e_nas_arm.out
- Size 2.1MB
- SHA256 e8cee8eab4020e1aadd4631ed626ab54d8733f8b14d683ca943cd4e124eeef55
Score3/10 -
- Target e_nas_x86.out
- Size 2.0MB
- SHA256 e505b24de50b14aed35cf40725dc0185cab06fed90269d445ec7a4b36de124b6
Score3/10 -
- Target e_win.bin
- Size 79KB
- SHA256 ea95f131bd9b49104d9e7ae83335254549ded9d71d557c6e4746740aecca2c85
Score10/10-
Family: Babuk Locker
RaaS first seen in 2021 initially called Vasa Locker.
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (172) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1