General

  • Target

    93fe277d54f4baac5762412dda6f831bf6a612f166daade7c23f6b38feac94fb.bin

  • Size

    212KB

  • Sample

    201106-7kttr7ccz6

  • MD5

    dea4027a50377c42ea9007e008dd345d

  • SHA1

    bb90e3e7983d27859727418d84a406b0da069560

  • SHA256

    93fe277d54f4baac5762412dda6f831bf6a612f166daade7c23f6b38feac94fb

  • SHA512

    f440d64d081741e49cfc425115e62d6470317118badcd9116ea1cac2f2d1e730ae485b1f27392125405c91381dfb93188ddd99dbfb2021044ca6f48fa25fa607

Malware Config

Extracted

Path

C:\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT

Family

buran

Ransom Note
!!! ALL YOUR FILES ARE ENCRYPTED !!! All your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. To be sure we have the decryptor and it works you can send an email: serioussam@firemail.cc and decrypt one file for free. But this file should be of not valuable! Do you really want to restore your files? Jabber: serioussam@thesecure.biz Write to email: serioussam@firemail.cc Your personal ID: 736-6D8-540 Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.
Emails

serioussam@firemail.cc

Extracted

Path

C:\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT

Family

buran

Ransom Note
!!! ALL YOUR FILES ARE ENCRYPTED !!! All your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. To be sure we have the decryptor and it works you can send an email: serioussam@firemail.cc and decrypt one file for free. But this file should be of not valuable! Do you really want to restore your files? Jabber: serioussam@thesecure.biz Write to email: serioussam@firemail.cc Your personal ID: EDD-183-890 Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.
Emails

serioussam@firemail.cc

Targets

    • Target

      93fe277d54f4baac5762412dda6f831bf6a612f166daade7c23f6b38feac94fb.bin

    • Size

      212KB

    • MD5

      dea4027a50377c42ea9007e008dd345d

    • SHA1

      bb90e3e7983d27859727418d84a406b0da069560

    • SHA256

      93fe277d54f4baac5762412dda6f831bf6a612f166daade7c23f6b38feac94fb

    • SHA512

      f440d64d081741e49cfc425115e62d6470317118badcd9116ea1cac2f2d1e730ae485b1f27392125405c91381dfb93188ddd99dbfb2021044ca6f48fa25fa607

    • Buran

      Ransomware-as-a-service based on the VegaLocker family first identified in 2019.

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

File Deletion

2
T1107

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Impact

Inhibit System Recovery

2
T1490

Tasks