zeppelin | 0e3a28023ba5030fbf2395239b89ca959982bbeec1972aa0adaae6c1fb44e08d

General

Target

1.exe
Size

214KB
Sample

220924-klnl6aahc4
MD5

9df62163926e1801587b0f824add2f1d
SHA1

2e4d3b2561e89844f01267bbd26383012931a773
SHA256

0e3a28023ba5030fbf2395239b89ca959982bbeec1972aa0adaae6c1fb44e08d
SHA512

b0ce0047a488a1df52fa7c0a4d180feeaa806858677f2fc0abe05450228aa3e00498797a7ac7f4fb9dcf442dd5cdd79e09cca42101259f0866f8699f80b4622e
SSDEEP

6144:syJE1yd7WHJmcyfjtPWna4DQFu/U3buRKlemZ9DnGAevIhdiMM+:sU/d7WsvBPWa4DQFu/U3buRKlemZ9DnG

Score

10^/10

Malware Config

Extracted

Path

C:\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT

Ransom Note

!!! ALL YOUR FILES ARE ENCRYPTED !!! All your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. To be sure we have the decryptor and it works you can send an email: [email protected] and decrypt one file for free. But this file should be of not valuable! Do you really want to restore your files? Write to email: [email protected] Reserved email: [email protected] 1. Visit https://tox.chat/download.html 2. Download and install qTOX on your PC. 3. Open it, click "New Profile" and create profile. 4. Click "Add friends" button and search our contact - 126E30C4CC9DE90F79D1FA90830FDC2069A2E981ED26B6DC148DA8827FB3D63A1B46CFDEC191 Your personal ID: E00-519-900 Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Emails

[email protected]

URLs

https://tox.chat/download.html

Extracted

Path

C:\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT

Ransom Note

!!! ALL YOUR FILES ARE ENCRYPTED !!! All your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. To be sure we have the decryptor and it works you can send an email: [email protected] and decrypt one file for free. But this file should be of not valuable! Do you really want to restore your files? Write to email: [email protected] Reserved email: [email protected] 1. Visit https://tox.chat/download.html 2. Download and install qTOX on your PC. 3. Open it, click "New Profile" and create profile. 4. Click "Add friends" button and search our contact - 126E30C4CC9DE90F79D1FA90830FDC2069A2E981ED26B6DC148DA8827FB3D63A1B46CFDEC191 Your personal ID: AFE-8C9-254 Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Emails

[email protected]

URLs

https://tox.chat/download.html

Targets

- Target
  
  1.exe
- Size
  
  214KB
- MD5
  
  9df62163926e1801587b0f824add2f1d
- SHA1
  
  2e4d3b2561e89844f01267bbd26383012931a773
- SHA256
  
  0e3a28023ba5030fbf2395239b89ca959982bbeec1972aa0adaae6c1fb44e08d
- SHA512
  
  b0ce0047a488a1df52fa7c0a4d180feeaa806858677f2fc0abe05450228aa3e00498797a7ac7f4fb9dcf442dd5cdd79e09cca42101259f0866f8699f80b4622e
- SSDEEP
  
  6144:syJE1yd7WHJmcyfjtPWna4DQFu/U3buRKlemZ9DnGAevIhdiMM+:sU/d7WsvBPWa4DQFu/U3buRKlemZ9DnG
Score

10^/10

zeppelin persistence ransomware
- Detects Zeppelin payload
- Zeppelin Ransomware
  Ransomware-as-a-service (RaaS) written in Delphi and first seen in 2019.
  ransomware zeppelin
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Executes dropped EXE
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
behavioral1 behavioral2