General
- Target e_win.exe
- Size 79KB
- Sample260414-sd6rrsd15p
- SHA256 0434726985a08e964c3b9826f52cd50aa33aece7e893f51bacdabdde42dbbc28
Score
10/10
Malware Config
Targets
-
- Target e_win.exe
- Size 79KB
- SHA256 0434726985a08e964c3b9826f52cd50aa33aece7e893f51bacdabdde42dbbc28
Score10/10-
Family: Babuk Locker
RaaS first seen in 2021 initially called Vasa Locker.
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (147) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.