Rorschach RansomwareMalware
- BabLock
Last reported 2 years ago, by Group-IB2 reports
ATT&CK techniques
6 of 40 · each with the sentence it comes from- T1003OS Credential Dumping
“T1003”
- T1007System Service Discovery
“T1007”
- T1018Remote System Discovery
“T1018”
- T1021.001Remote Desktop Protocol
“T1021.001”
- T1021.004SSH
“T1021.004”
- T1027Obfuscated Files or Information
“T1027”
What the reports say
2 reports, newest first · the exact sentence from each-
Eldorado Ransomware: The New Golden Empire of Cybercrime?“Notable examples include the LIMPOPO (aka SOCOTRA, FORMOSA, SEXi) ransomware group, BabLock ransomware, and Estate ransomware.”
-
The old way: BabLock, new ransomware quietly cruising around Europe, Middle East, and Asia“The old way: BabLock, new ransomware quietly cruising around Europe, Middle East, and Asia”
Indicators in its reports
named in the reports above- main[.]ecin 1 report
- 173.44.141[.]152in 1 report
- ntdetect[.]comin 1 report
- 1375e5d7f672bfd4…f6eb0ab9f27bin 1 report
- 7f21d5c966f4fd1a…f3f122ae66ddin 1 report
- cb0b9e509a0f16eb…8d96736174a7in 1 report
- b2266ee3c6780918…d379f12c70dein 1 report
- dc4092a476c29b85…a01f22258c33in 1 report
Copy these 8 indicators · defanged
Thanks — we review every report.