General

  • Target

    Screenshot00112021.scr.exe

  • Size

    288KB

  • Sample

    211115-qxdtzsfdhl

  • MD5

    dd8b6f163544a37fc7aa6f09052a391b

  • SHA1

    2e3c83a2c778838a795d06682afb6169e672cc22

  • SHA256

    0b3932739176975ad69bae0a03171746b7efa1c3909cf5206dcb3b89d1947b15

  • SHA512

    499dd0c1214e5ea4b7a9f64149fa118c047b836fffd52b3f3424b1aae84d463d25dc75e7e8fcb706040601b56659ca1228a113ffdb1b4a634ded12fdfb8a8022

Malware Config

Extracted

Path

C:\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT

Family

buran

Ransom Note
!!! ALL YOUR FILES ARE ENCRYPTED !!! All your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. To be sure we have the decryptor and it works you can send an email: [email protected] and decrypt one file for free. But this file should be of not valuable! Do you really want to restore your files? Write to email: [email protected] Reserved email: [email protected] Reserved email: [email protected] Your personal ID: 206-FAD-AEC Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Extracted

Path

C:\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT

Family

buran

Ransom Note
!!! ALL YOUR FILES ARE ENCRYPTED !!! All your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. To be sure we have the decryptor and it works you can send an email: [email protected] and decrypt one file for free. But this file should be of not valuable! Do you really want to restore your files? Write to email: [email protected] Reserved email: [email protected] Reserved email: [email protected] Your personal ID: A54-05F-F60 Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Targets

    • Target

      Screenshot00112021.scr.exe

    • Size

      288KB

    • MD5

      dd8b6f163544a37fc7aa6f09052a391b

    • SHA1

      2e3c83a2c778838a795d06682afb6169e672cc22

    • SHA256

      0b3932739176975ad69bae0a03171746b7efa1c3909cf5206dcb3b89d1947b15

    • SHA512

      499dd0c1214e5ea4b7a9f64149fa118c047b836fffd52b3f3424b1aae84d463d25dc75e7e8fcb706040601b56659ca1228a113ffdb1b4a634ded12fdfb8a8022

    • Buran

      Ransomware-as-a-service based on the VegaLocker family first identified in 2019.

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Executes dropped EXE

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v6

Tasks