Geek Guy

Month: February 2021

Babuk is distributed packed

a new babuk ransomware was uploaded on Virustotal. bc4066c3b8d2bb4af593ced9905d1c9c78fff5b10ab8dbed7f45da913fb2d748 This version is packed with the same technics of GandGrab described here. Threat Profile: GandCrab Ransomware (morphisec.com) Packer The first stage is a first shellcode loaded with GloballAlloc and VirtualProtect in function 0042df00 This shellcode create a second shellcode after a VirtualAlloc and VirtualProtect to change rights…