General

  • Target

    11898.exe20211207192243.rar

  • Size

    190KB

  • Sample

    211208-g3sqnabag3

  • MD5

    3f9f101c70fcdfb68f1e2efe29be8fb9

  • SHA1

    b1fc0664cc89ec7c332749ec8644c10ccdda3a81

  • SHA256

    6f3aeeebda1bd67e5acd2eb8f8bbe6a887e8f787886a561be5e7caf43cf1f7a9

  • SHA512

    1715654831ec99d1a4d51639f8f4362ac43982ab070d273772753ca728ad6863fad5b9f021e11196f03e137da9bdc4680c3f8075e9619bb2e3f29d379e4eef23

Malware Config

Extracted

Path

C:\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT

Family

buran

Ransom Note
!!! ALL YOUR FILES ARE ENCRYPTED !!! All your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. To be sure we have the decryptor and it works you can send an email: [email protected] and decrypt one file for free. But this file should be of not valuable! Do you really want to restore your files? Write to email: [email protected] Reserved email: [email protected] Reserved email: [email protected] Your personal ID: 1CE-1E4-C24 Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Extracted

Path

C:\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT

Family

buran

Ransom Note
!!! ALL YOUR FILES ARE ENCRYPTED !!! All your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. To be sure we have the decryptor and it works you can send an email: [email protected] and decrypt one file for free. But this file should be of not valuable! Do you really want to restore your files? Write to email: [email protected] Reserved email: [email protected] Reserved email: [email protected] Your personal ID: 122-808-748 Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Targets

    • Target

      11898.exe

    • Size

      250KB

    • MD5

      693dec99f9767c1d004f6289065471a0

    • SHA1

      91cd7cd10fd1c075f47b84d97f17cc2c1e92e9ac

    • SHA256

      56dc200341cac71492c374d9251791c60308d96d4387a8bbae999fdb5d841375

    • SHA512

      b98942b9eff9e1a9a4dac0c3a53c76138a471419b68d77513bc8854824b8ddb707ec51344d13fdd659f9707985efee7f1b9669e357987d9e65382e76fa6f34c1

    • Buran

      Ransomware-as-a-service based on the VegaLocker family first identified in 2019.

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

File Deletion

2
T1107

Modify Registry

2
T1112

Install Root Certificate

1
T1130

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Command and Control

Web Service

1
T1102

Impact

Inhibit System Recovery

2
T1490

Tasks