General
- Target 5615482142228480.zip
- Size 182KB
- Sample201217-cjpmcg8m7a
- SHA256 eba3e153c13f618ceef6c2cc58f67d19b008adb87d4ea0ae9861a63072b8738d
Score
10/10
Malware Config
Extracted
Path
-
C:\!!! HOW TO BACK YOUR FILES !!!.TXT
-
buran
Ransom Note
- YOUR FILES ARE ENCRYPTED !!! TO DECRYPT, FOLLOW THE INSTRUCTIONS: To recover data you need decrypt tool. To get the decrypt tool you should: 1.In the letter include your personal ID! Send me this ID in your first email to me! 2.We can give you free test for decrypt few files (NOT VALUE) and assign the price for decryption all files! 3.After we send you instruction how to pay for decrypt tool and after payment you will receive a decryption tool! 4.We can decrypt few files in quality the evidence that we have the decoder. DO NOT TRY TO DO SOMETHING WITH YOUR FILES BY YOURSELF YOU WILL BRAKE YOUR DATA !!! ONLY WE ARE CAN HELP YOU! CONTACT US: [email protected] ATTENTION !!! THIS IS YOUR PERSONAL ID WICH YOU HAVE TO SEND IN FIRST LETTER: Your personal ID: 1B9-E69-EAA Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.
Extracted
Path
-
C:\!!! HOW TO BACK YOUR FILES !!!.TXT
-
buran
Ransom Note
- YOUR FILES ARE ENCRYPTED !!! TO DECRYPT, FOLLOW THE INSTRUCTIONS: To recover data you need decrypt tool. To get the decrypt tool you should: 1.In the letter include your personal ID! Send me this ID in your first email to me! 2.We can give you free test for decrypt few files (NOT VALUE) and assign the price for decryption all files! 3.After we send you instruction how to pay for decrypt tool and after payment you will receive a decryption tool! 4.We can decrypt few files in quality the evidence that we have the decoder. DO NOT TRY TO DO SOMETHING WITH YOUR FILES BY YOURSELF YOU WILL BRAKE YOUR DATA !!! ONLY WE ARE CAN HELP YOU! CONTACT US: [email protected] ATTENTION !!! THIS IS YOUR PERSONAL ID WICH YOU HAVE TO SEND IN FIRST LETTER: Your personal ID: 113-B5B-0D4 Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.
Targets
-
- Target f9fcc0cddd57b377a8aa65a713ddbe986cda2e188e037cbd706c81096059c9d5
- Size 450KB
- SHA256 f9fcc0cddd57b377a8aa65a713ddbe986cda2e188e037cbd706c81096059c9d5
Score10/10Buran
Ransomware-as-a-service based on the VegaLocker family first identified in 2019.
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
Executes dropped EXE
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
Loads dropped DLL
Adds Run key to start application
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.