39688a7dc3f4d8586bab557d11f042406244ccbf544042c2dba9a52210e19885

General

Target
2026-09-07_375b4a1e0a1fe7b5b4e208c9975cde5c_babuk_destroyer_elex
Size 82KB
Sample260909-d9lddabk2w
SHA256 39688a7dc3f4d8586bab557d11f042406244ccbf544042c2dba9a52210e19885
MD5 375b4a1e0a1fe7b5b4e208c9975cde5c
SHA1 32e45df2749f74425358e88730832e89b8a2a6d1
SHA512 59d72e268a14c6c1382a99d8947525896ae3453a801348a70bc421f4f3326827577d9238688846196292ff308950988adee064f34f198c1d38944b45e4d6dff6
SSDEEP 1536:M8KsabEM8196NA+J9srQLOJgY8ZZP8LHD4XWaNH71dLdG1iiFM2iG2+qn:ppvM818As9srQLOJgY8Zp8LHD4XWaNHB
TLSH
T14D83C8115985D2B6D6D2223191B3F1AAC13A29700375A74F63C017AEFB11AD8F6BCF27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Path

C:\Recovery\WindowsRE\RECOVER-README.txt

Ransom Note

--KRYBIT Your network/system was encrypted. Encrypted files have new extension. --Blog http://krybitxdpxohsmjooeb3gbgpmdddreh6mnflzac6bnezz74b7yje67yd.onion/ http://krybitx3fh5krdnhegyp2ob3lhizsaiadturtio3ginf7it5gsdgu2yd.onion/ http://krybitqsdzwmhnitvwuhvsntfgf2wrhxveyxroxpc44c6gkft2cqldyd.onion/ http://krybieodq754vlwufrsuxaswxb5zpxyibaawmed2jaduoz2e5m56hmid.onion/ -- Compromising and sensitive data We have downloaded compromising and sensitive data from you system/network If you refuse to communicate with us and we do not come to an agreement, your data will be published. Data includes: - Employees personal data, CVs, DL , SSN. - Complete network map including credentials for local and remote services. - Financial information including clients data, bills, budgets, annual reports, bank statements. - Complete datagrams/schemas/drawings for manufacturing in solidworks format - And more... -- Warning If you modify files - our decrypt software won't able to recover data If you use third party software - you can damage/modify files (see item 1) You need cipher key / our decrypt software to restore you files. The police or authorities will not be able to help you get the cipher key. We encourage you to consider your decisions. -- Recovery 1) Download tor browser: https://www.torproject.org/download/ 2) Visit the chat: http://krybitxdpxohsmjooeb3gbgpmdddreh6mnflzac6bnezz74b7yje67yd.onion/chat/0a0a926b7ae6c21d696580d91e2765f15dce9063180514e581eee79764a197d8/ 3) Use this ID to log in: 0a0a926b7ae6c21d696580d91e2765f15dce9063180514e581eee79764a197d8 Support in case chat is down (https://getsession.org/download): 054229c17f1ce65f5f91b0ec2f53b90ef8e0220441ac42ad5eee9fd076da2d5044

URLs

http://krybitxdpxohsmjooeb3gbgpmdddreh6mnflzac6bnezz74b7yje67yd.onion/
http://krybitx3fh5krdnhegyp2ob3lhizsaiadturtio3ginf7it5gsdgu2yd.onion/
http://krybitqsdzwmhnitvwuhvsntfgf2wrhxveyxroxpc44c6gkft2cqldyd.onion/
http://krybieodq754vlwufrsuxaswxb5zpxyibaawmed2jaduoz2e5m56hmid.onion/
http://krybitxdpxohsmjooeb3gbgpmdddreh6mnflzac6bnezz74b7yje67yd.onion/chat/0a0a926b7ae6c21d696580d91e2765f15dce9063180514e581eee79764a197d8/
https://getsession.org/download

Targets

- Target
  2026-09-07_375b4a1e0a1fe7b5b4e208c9975cde5c_babuk_destroyer_elex
- Size 82KB
- SHA256 39688a7dc3f4d8586bab557d11f042406244ccbf544042c2dba9a52210e19885
- MD5 375b4a1e0a1fe7b5b4e208c9975cde5c
- SHA1 32e45df2749f74425358e88730832e89b8a2a6d1
- SHA512 59d72e268a14c6c1382a99d8947525896ae3453a801348a70bc421f4f3326827577d9238688846196292ff308950988adee064f34f198c1d38944b45e4d6dff6
- SSDEEP 1536:M8KsabEM8196NA+J9srQLOJgY8ZZP8LHD4XWaNH71dLdG1iiFM2iG2+qn:ppvM818As9srQLOJgY8Zp8LHD4XWaNHB
- TLSH
  T14D83C8115985D2B6D6D2223191B3F1AAC13A29700375A74F63C017AEFB11AD8F6BCF27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution impact ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Renames multiple (174) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2