General
- Target 2026-08-14_21dcc56d58f5aec984afb38a076d3512_destroyer_elex
- Size 81KB
- Sample260814-fm9tkafd34
- SHA256 f2a8ea0f783d72cf1831b9f4a440fa96235443625b1dcb95fd8fb5def047fb7b
Score
10/10
Malware Config
Targets
-
- Target 2026-08-14_21dcc56d58f5aec984afb38a076d3512_destroyer_elex
- Size 81KB
- SHA256 f2a8ea0f783d72cf1831b9f4a440fa96235443625b1dcb95fd8fb5def047fb7b
Score10/10-
Family: Babuk Locker
RaaS first seen in 2021 initially called Vasa Locker.
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Detects command variations typically used by ransomware
-
Detects executables containing many references to VEEAM. Observed in ransomware
-
Renames multiple (190) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.