Overview

overview

10

Static

static

2988.js

windows7_x64

10

2988.js

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2988.zip

  • Size

    427KB

  • Sample

    210810-8tcx1fnns6

  • MD5

    6a36fca9f379b98c8c762036d066f04b

  • SHA1

    6bde482cbb536c4b6f6dfce935633eaa8264018f

  • SHA256

    e747eb439e6de1810c84d328c6c015365a0b48d87a6e2b12dd9339665ad6af77

  • SHA512

    cd432f4f4ef3c34a487c40acb6e9bd27ff7749b4694607a593f7849c32465b4a7a11d1b1b540e9908b6f2a4f0448bddb0b849c6fae4d1889d40b4000e2fbabc6

Score
10/10
buranpersistenceransomware

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://erzurum.us/65376345273497600381/tjTyjrjywrdmJoaaenvF/dll/assistant.php

Extracted

Path

C:\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT

Family

buran

Ransom Note
!!! ALL YOUR FILES ARE ENCRYPTED !!! All your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. To be sure we have the decryptor and it works you can send an email: kd8eby0@inboxhub.net and decrypt one file for free. But this file should be of not valuable! Do you really want to restore your files? Write to email: kd8eby0@inboxhub.net Reserved email: kd8eby0@onionmail.org Reserved email: kd8eby0@nuke.africa Your personal ID: 16F-6D0-544 Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.
Emails

kd8eby0@onionmail.org

kd8eby0@nuke.africa

Targets

    • Target

      2988.js

    • Size

      702KB

    • MD5

      5722cc13cc4d2f58cbc35fa38d33a208

    • SHA1

      431326c4fd9f62457f56aa6e9a0ee86c9fe5b7f7

    • SHA256

      bb96e1541b8ff33e5ff71c2d4298019f815a93a5c5f84d46197212784f5ef804

    • SHA512

      21febe0557b5ea65bcac19668777ee75e10a96eabc85eb421c4c747c6ea9a10d0ce2a1c7b8f579d832c226216579e498164efd4cf481176479d66a9672866eda

    Score
    10/10
    buranpersistenceransomware

    • Buran

      Ransomware-as-a-service based on the VegaLocker family first identified in 2019.

      ransomwareburan

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

File Deletion

2
T1107

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Inhibit System Recovery

2
T1490

Tasks