buran

General

Target

0a49373e97366040658acf1971695740342c623beab93fc493cb2dadda5814e6
Size

423KB
Sample

220328-wxwyfsdbd5
MD5

b8546e288ba47f4be8615e73d26f2215
SHA1

0204fc6d8f011efc4ba2fafe5bf5ba7bbb2be50e
SHA256

0a49373e97366040658acf1971695740342c623beab93fc493cb2dadda5814e6
SHA512

29f91d6b359eb9115414726d2444187864f13904efd0653a8500dfd608a9598b08b3cee86503dd2fee507f6e3aff98773b5c46bab14dbfa880c5aa47c79e32f4

Score

10^/10

Malware Config

Extracted

Path

C:\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT

Family

buran

Ransom Note

!!! ALL YOUR FILES ARE ENCRYPTED !!! All your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. To be sure we have the decryptor and it works you can send an email: [email protected] and decrypt one file for free. But this file should be of not valuable! Do you really want to restore your files? Write to email: [email protected] Reserved email: [email protected] Your personal ID: F0D-028-47E Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Emails

[email protected]

Extracted

Path

C:\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT

Family

buran

Ransom Note

!!! ALL YOUR FILES ARE ENCRYPTED !!! All your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. To be sure we have the decryptor and it works you can send an email: [email protected] and decrypt one file for free. But this file should be of not valuable! Do you really want to restore your files? Write to email: [email protected] Reserved email: [email protected] Your personal ID: 239-D38-4A1 Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Emails

[email protected]

Targets

- Target
  
  0a49373e97366040658acf1971695740342c623beab93fc493cb2dadda5814e6
- Size
  
  423KB
- MD5
  
  b8546e288ba47f4be8615e73d26f2215
- SHA1
  
  0204fc6d8f011efc4ba2fafe5bf5ba7bbb2be50e
- SHA256
  
  0a49373e97366040658acf1971695740342c623beab93fc493cb2dadda5814e6
- SHA512
  
  29f91d6b359eb9115414726d2444187864f13904efd0653a8500dfd608a9598b08b3cee86503dd2fee507f6e3aff98773b5c46bab14dbfa880c5aa47c79e32f4
Score

10^/10

buran persistence ransomware
- Buran
  Ransomware-as-a-service based on the VegaLocker family first identified in 2019.
  ransomware buran
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2