Overview

overview

10

Static

static

10

2026-07-20...ex.exe

windows10-2004-x64

10

2026-07-20...ex.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2026-07-20_030085f202d1ccb73a0dc0b7eb6e1787_babuk_destroyer_elex
  • Size 82KB
  • Sample260720-mp5e7ae16m
  • SHA256 e1307551f743dbb104bda7200a51ca2bb7caf5ed381c36c2a5ebdf735eb75cd8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionimpactransomware

Malware Config

Extracted

Path

  • C:\Recovery\WindowsRE\RECOVER-README.txt

Ransom Note
  • --KRYBIT Your network/system was encrypted. Encrypted files have new extension. --Blog http://krybitxdpxohsmjooeb3gbgpmdddreh6mnflzac6bnezz74b7yje67yd.onion/ http://krybitx3fh5krdnhegyp2ob3lhizsaiadturtio3ginf7it5gsdgu2yd.onion/ http://krybitqsdzwmhnitvwuhvsntfgf2wrhxveyxroxpc44c6gkft2cqldyd.onion/ http://krybieodq754vlwufrsuxaswxb5zpxyibaawmed2jaduoz2e5m56hmid.onion/ -- Compromising and sensitive data We have downloaded compromising and sensitive data from you system/network If you refuse to communicate with us and we do not come to an agreement, your data will be published. Data includes: - Employees personal data, CVs, DL , SSN. - Complete network map including credentials for local and remote services. - Financial information including clients data, bills, budgets, annual reports, bank statements. - Complete datagrams/schemas/drawings for manufacturing in solidworks format - And more... -- Warning If you modify files - our decrypt software won't able to recover data If you use third party software - you can damage/modify files (see item 1) You need cipher key / our decrypt software to restore you files. The police or authorities will not be able to help you get the cipher key. We encourage you to consider your decisions. -- Recovery 1) Download tor browser: https://www.torproject.org/download/ 2) Visit the chat: http://krybitx3fh5krdnhegyp2ob3lhizsaiadturtio3ginf7it5gsdgu2yd.onion/chat/c278bf821b8ec52493594597d5a49f4296eeaf3cb52febf4d61f0151445fd952/ 3) Use this ID to log in: c278bf821b8ec52493594597d5a49f4296eeaf3cb52febf4d61f0151445fd952 Support in case chat is down (https://getsession.org/download): 054229c17f1ce65f5f91b0ec2f53b90ef8e0220441ac42ad5eee9fd076da2d5044
URLs

  • http://krybitxdpxohsmjooeb3gbgpmdddreh6mnflzac6bnezz74b7yje67yd.onion/

  • http://krybitx3fh5krdnhegyp2ob3lhizsaiadturtio3ginf7it5gsdgu2yd.onion/

  • http://krybitqsdzwmhnitvwuhvsntfgf2wrhxveyxroxpc44c6gkft2cqldyd.onion/

  • http://krybieodq754vlwufrsuxaswxb5zpxyibaawmed2jaduoz2e5m56hmid.onion/

  • http://krybitx3fh5krdnhegyp2ob3lhizsaiadturtio3ginf7it5gsdgu2yd.onion/chat/c278bf821b8ec52493594597d5a49f4296eeaf3cb52febf4d61f0151445fd952/

  • https://getsession.org/download

Targets

    • Target
      2026-07-20_030085f202d1ccb73a0dc0b7eb6e1787_babuk_destroyer_elex
    • Size 82KB
    • SHA256 e1307551f743dbb104bda7200a51ca2bb7caf5ed381c36c2a5ebdf735eb75cd8
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    defense_evasiondiscoveryexecutionimpactransomware

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Renames multiple (129) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks