babuk | 5b85553e0dd27a9279c2e23855789e3b7ae5f2abe4556329892861f20142db5e

General

Target
84195730129823c9956a2a10a20776a88aa8e613cbef264e610a50f4fb68543c.zip
Size 46KB
Sample260702-dnnavabv2t
SHA256 5b85553e0dd27a9279c2e23855789e3b7ae5f2abe4556329892861f20142db5e
MD5 055e865425c02a85793d328eb51fb92f
SHA1 ba02abc20a54af6652295c46b389248e25e00a6c
SHA512 c9ad5ee5d2c8840e80da4bcf758bf285eea6acf1e44acaa72a4090ddd9066896c7fe68757832ce2457a5421ba9d072933c5f71a9f589c288275a6fa5f640a6c0
SSDEEP 768:tAwVPvK400FITuuS4w3zNsZNaz5qIs0WFJlwIvaUodTxThj9wEXOyGkbdGP:tAwFj0fyuTwuN0X4JmD1ThjpGk8
TLSH
T13F2302B88256330B074FC08DCBAB54B56DEE81667A1115C93DDF4D721EA83ABF650C08
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Path

C:\PerfLogs\How To Restore Your Files.txt

Ransom Note

----------- [ Hello! ] -------------> ****BY FLUX LOCKER**** What happened? ---------------------------------------------- Your network has been breached. Your computers, servers, and local backupshave been encrypted using a powerful cryptographic algorithm. Furthermore,to restore your entire network. Follow our instructions below to recover all your data. What guarantees? ---------------------------------------------- We value our reputation. If we do not do our work and liabilities, nobody will pay us. This is not in our interests. All our decryption software is perfectly tested and will decrypt your data. We will also provide support in case of problems. We guarantee to decrypt one file for free. Go to the site and contact us. How to contact us? ---------------------------------------------- Use gmail to chat us and chat us in the gmail/proton ([email protected])) you'll get instructions on how to buy the decoder and decrypt your data. we receive hundreds of messages every day, so we will reply to you as soon as possible. !!! DANGER !!! DO NOT MODIFY or try to RECOVER any files yourself. We WILL NOT be able to RESTORE them. !!! DANGER !!

Emails

[email protected]

Targets

- Target
  84195730129823c9956a2a10a20776a88aa8e613cbef264e610a50f4fb68543c
- Size 46KB
- SHA256 84195730129823c9956a2a10a20776a88aa8e613cbef264e610a50f4fb68543c
- MD5 1a1fa5f5f6858550d46d8d07594a0147
- SHA1 29c6db1b71bda6d0ec85a696bd1e72569e3d84ed
- SHA512 6dd08d688860b7af2d5c9da47b196129d29f342f29905eb4ff573ff43f806793f73ff76484eb220ee63a352afe6194a32ddafaf53cd7811c11349cca8513222d
- SSDEEP 768:IygxkWvxxe5KA/5smzOe3Ql6WQAqUbjnG6qzZD+:5UzvDIKAxae3/nzUu
- TLSH
  T1DA23091AFEE3D0ECC126D5B492F98A36F572FC5104305E2E43D0DA761E66A509E2CE1B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access defense_evasion discovery execution babuk impact ransomware spyware stealer
- Family: Babuk Locker
  RaaS first seen in 2021 initially called Vasa Locker.
  ransomware babuk
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Renames multiple (2362) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2