MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a72cd6dcf20df1725db00b53e95a35cc02490a974845b2f0e45db94d85eb69ff. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Babuk


Vendor detections: 10


Intelligence 10 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a72cd6dcf20df1725db00b53e95a35cc02490a974845b2f0e45db94d85eb69ff
SHA3-384 hash: 1797a13bb3d4574ec26013a7c30645f37fc598ca2e0bcee5d419c4ad43d3e35365833a13f4b1dedda6955a7527016deb
SHA1 hash: 80469c357a3d80da20d3d6053370ee011663c7c0
MD5 hash: 214d097d63c0aa20ae2a833518c583a1
humanhash: yellow-zulu-network-quebec
File name:1.exe
Download: download sample
Signature Babuk
Create hunting rule
File size:4'779'717 bytes
First seen:2023-11-12 11:45:44 UTC
Last seen:2025-04-22 05:02:55 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 25c710ff0d95f3d950545372a5adf52a (2 x Cactus, 1 x Babuk)
ssdeep 98304:nAxfEfPkvm2ysI39biVhWo0tOUHu345hsMXWrGCTFY:nQfBisDhWo0tOUHh
TLSH T145263B8228DF0D9ADDC13BB8A1C3632A677CBE61CF6B4F27A60841355D532C57D2AB50
TrID 51.0% (.EXE) UPX compressed Win64 Executable (70117/5/12)
19.7% (.EXE) UPX compressed Win32 Executable (27066/9/6)
12.0% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
7.6% (.EXE) Win64 Executable (generic) (10523/12/4)
3.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
Reporter Xev
Tags:Babuk exe Ransomware

Intelligence

File Origin
# of uploads :
4
# of downloads :
792
Origin country :
GR GR
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.FileRepMalware.17096.22767.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Сreating synchronization primitives
Searching for the window
Sending a custom TCP request
Gathering data
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-debug expand lolbin overlay packed packed packed shell32 upx
Link:
https://www.filescan.io/uploads/6550bafc946b6ab2245f9360/reports/e322eddb-1ee9-44fe-9a77-55281c9bba2e/overview
Verdict:
Malicious
Labled as:
Ransom.Cactus.A.Generic
Link:
https://www.hybrid-analysis.com/sample/a72cd6dcf20df1725db00b53e95a35cc02490a974845b2f0e45db94d85eb69ff
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/536dde1e-1e60-4656-ae97-e6b823d96f40
Result
Threat name:
Babuk
Create hunting rule
Detection:
malicious
Classification:
rans.evad
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/1341308
Signature
Deletes shadow drive data (may be related to ransomware)
Found Tor onion address
Multi AV Scanner detection for submitted file
Yara detected Babuk Ransomware
Behaviour
Behavior Graph:
Download SVG
Score:
93%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/a72cd6dcf20df1725db00b53e95a35cc02490a974845b2f0e45db94d85eb69ff
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a72cd6dcf20df1725db00b53e95a35cc02490a974845b2f0e45db94d85eb69ff/
Threat name:
Win64.Ransomware.Cactus
Create hunting rule
Status:
Malicious
First seen:
2023-11-12 11:46:07 UTC
File Type:
PE+ (Exe)
Extracted files:
3
AV detection:
14 of 38 (36.84%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=u4wnnxhsbxyxexnqbnj6swrvzqbescuxjbc3f4helw4u3bplnh7q._file
Verdict:
unknown
Result
Malware family:
n/a
Score:
  7/10
Tags:
upx
Link:
https://tria.ge/reports/231112-nxaffsfa4s/
Behaviour
UPX packed file
Unpacked files
SH256 hash:
1000cd4b74290bcecbe1be07146dad30a46f264bfeb0b8ceb00c83a6ff1e70d9
MD5 hash:
6bafa6190e30fcae5dda8017079f9980
SHA1 hash:
d0d1e681ffc455c226494938da01639d025c01bc
Detections:
CactusRansomware
Create hunting rule
Link:
https://www.unpac.me/results/ab93e16b-5ffb-4dc8-92f4-a3e55c9ed506/
Parent samples :
a72cd6dcf20df1725db00b53e95a35cc02490a974845b2f0e45db94d85eb69ff
1000cd4b74290bcecbe1be07146dad30a46f264bfeb0b8ceb00c83a6ff1e70d9
SH256 hash:
a72cd6dcf20df1725db00b53e95a35cc02490a974845b2f0e45db94d85eb69ff
MD5 hash:
214d097d63c0aa20ae2a833518c583a1
SHA1 hash:
80469c357a3d80da20d3d6053370ee011663c7c0
Link:
https://www.unpac.me/results/ab93e16b-5ffb-4dc8-92f4-a3e55c9ed506/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.56
Link:
https://yomi.yoroi.company/submissions/a72cd6dcf20df1725db00b53e95a35cc02490a974845b2f0e45db94d85eb69ff

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:upxHook
Create hunting rule
Author:@r3dbU7z
Description:Detect artifacts from 'upxHook' - modification of UPX packer
Reference:https://bazaar.abuse.ch/sample/6352be8aa5d8063673aa428c3807228c40505004320232a23d99ebd9ef48478a/
Rule name:WHIRLPOOL_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for WhirlPool constants

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments