buran

General

Target

7b560460b14741999a04a72415bb7b4872739410833b4f6970abaa928ddcab16
Size

211KB
Sample

220306-g11cqaabe6
MD5

6e789d89c3817997e791a62a91a392dd
SHA1

b88feefd90de401dabf9f1574fb2b47de608b010
SHA256

7b560460b14741999a04a72415bb7b4872739410833b4f6970abaa928ddcab16
SHA512

ab76d49de89d4e8c734bcb4ccd61dd71466a8cbb594eb152e35fea3806324ca9b05b60662f32e57b1d4461c38b8ff2cf631a267b7a3e5000b9977625dbaa8e3c

Score

10^/10

Malware Config

Extracted

Path

C:\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT

Family

buran

Ransom Note

!!! ALL YOUR FILES ARE ENCRYPTED !!! All your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. To be sure we have the decryptor and it works you can send an email: [email protected] and decrypt one file for free. But this file should be of not valuable! Do you really want to restore your files? Write to email: [email protected] Reserved email: [email protected] Your personal ID: 1B0-3EA-C30 Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Emails

[email protected]

Extracted

Path

C:\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT

Family

buran

Ransom Note

!!! ALL YOUR FILES ARE ENCRYPTED !!! All your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. To be sure we have the decryptor and it works you can send an email: [email protected] and decrypt one file for free. But this file should be of not valuable! Do you really want to restore your files? Write to email: [email protected] Reserved email: [email protected] Your personal ID: 354-97A-B1F Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Emails

[email protected]

Targets

- Target
  
  7b560460b14741999a04a72415bb7b4872739410833b4f6970abaa928ddcab16
- Size
  
  211KB
- MD5
  
  6e789d89c3817997e791a62a91a392dd
- SHA1
  
  b88feefd90de401dabf9f1574fb2b47de608b010
- SHA256
  
  7b560460b14741999a04a72415bb7b4872739410833b4f6970abaa928ddcab16
- SHA512
  
  ab76d49de89d4e8c734bcb4ccd61dd71466a8cbb594eb152e35fea3806324ca9b05b60662f32e57b1d4461c38b8ff2cf631a267b7a3e5000b9977625dbaa8e3c
Score

10^/10

buran persistence ransomware
- Buran
  Ransomware-as-a-service based on the VegaLocker family first identified in 2019.
  ransomware buran
- Executes dropped EXE
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2