Overview

overview

10

Static

static

10

2026-06-28...ex.exe

windows10-2004-x64

10

2026-06-28...ex.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2026-06-28_713b8b0088f55a80fff60a01a8a2d223_babuk_destroyer_elex
  • Size 79KB
  • Sample260628-1mcjaaey2w
  • SHA256 4837615a21deb15fa32f807286fd9a953f9cb9983f69bac533b91cf7b03e238b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
babukdefense_evasiondiscoveryexecutionimpactransomware

Malware Config

Extracted

Path

  • C:\Users\How To Restore Your Files.txt

Ransom Note
  • --------------- Hello --------------- *** By BABUCK LOCKER *** Your computers and servers are encrypted, and backups are deleted. We use strong encryption algorithms, so no one has yet been able to decrypt their files without our participation. The only way to decrypt your files is to purchase a universal decoder from us, which will restore all the encrypted data and your network. Follow our instructions below, and you will recover all your data: 1) Pay 0,006 bitcoin to 1E6cvG6iEbufvYspsDa3XQ3WJgEMvRTm9i 2) Send us message with transaction id to [email protected] 3) Launch decryptor.exe, which our support will send you through email What guarantees? ----------------------------------------------------- We value our reputation. If we will not do our work and liabilities, nobody will pay us. This is not in our interests. All our decryption software is tested by time and will decrypt all your data. ----------------------------------------------------- !!! DO NOT TRY TO RECOVER ANY FILES YOURSELF. WE WILL NOT BE ABLE TO RESTORE THEM!!!
Wallets

  • 1E6cvG6iEbufvYspsDa3XQ3WJgEMvRTm9i

Targets

    • Target
      2026-06-28_713b8b0088f55a80fff60a01a8a2d223_babuk_destroyer_elex
    • Size 79KB
    • SHA256 4837615a21deb15fa32f807286fd9a953f9cb9983f69bac533b91cf7b03e238b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    defense_evasiondiscoveryexecutionbabukimpactransomware

    • Family: Babuk Locker

      RaaS first seen in 2021 initially called Vasa Locker.

      ransomwarebabuk

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Renames multiple (154) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks