General

  • Target

    aaaa.exe

  • Size

    211KB

  • Sample

    211013-hnt6lsdff8

  • MD5

    935f54b6609c5339001579e96dc34244

  • SHA1

    a809327d39fab61bfcfac0c97b1d4b3bfb9a2cfe

  • SHA256

    a5847867730e7849117c31cdae8bb0a25004635d49f366fbfaebce034d865d7d

  • SHA512

    3daa9be6c8489007f1e410332fa670e56bde060347b02f31a1621039215c254f05284e86f39293a9f5c0add64cc4735d128c3f1c409e62623a7b50de393bd843

Malware Config

Extracted

Path

C:\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT

Family

buran

Ransom Note
!!! ALL YOUR FILES ARE ENCRYPTED !!! All your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. To be sure we have the decryptor and it works you can send an email: [email protected] and decrypt one file for free. But this file should be of not valuable! Do you really want to restore your files? Write to email: [email protected] Reserved email: [email protected] Your personal ID: 9BA-DF7-FEB Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Extracted

Path

C:\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT

Family

buran

Ransom Note
!!! ALL YOUR FILES ARE ENCRYPTED !!! All your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. To be sure we have the decryptor and it works you can send an email: [email protected] and decrypt one file for free. But this file should be of not valuable! Do you really want to restore your files? Write to email: [email protected] Reserved email: [email protected] Your personal ID: 252-598-BFE Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Targets

    • Target

      aaaa.exe

    • Size

      211KB

    • MD5

      935f54b6609c5339001579e96dc34244

    • SHA1

      a809327d39fab61bfcfac0c97b1d4b3bfb9a2cfe

    • SHA256

      a5847867730e7849117c31cdae8bb0a25004635d49f366fbfaebce034d865d7d

    • SHA512

      3daa9be6c8489007f1e410332fa670e56bde060347b02f31a1621039215c254f05284e86f39293a9f5c0add64cc4735d128c3f1c409e62623a7b50de393bd843

    • Buran

      Ransomware-as-a-service based on the VegaLocker family first identified in 2019.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

2
T1120

System Information Discovery

3
T1082

Tasks