buran

General

Target

6a4c8a0b7622b3621900bf47acb16725c4a8dafde394f2bf2bf7112bd90a3408
Size

215KB
Sample

221027-ntdzgacafn
MD5

e71825acc5c0dbf948ec73b12c397a23
SHA1

efe7521f2f6f06840418ca99b57989ec7dd797c5
SHA256

6a4c8a0b7622b3621900bf47acb16725c4a8dafde394f2bf2bf7112bd90a3408
SHA512

c9369d2a89f54250149b3a92d1d12b2f1a38fcf76e961d08f5ea4c3aec29bc338d8d5113df0bdd35aed5ff2d4c2d71ac3195e27d72489d9275553833314d7fe5
SSDEEP

6144:cyJE1yd7WEJmcyf70PWna4DQFu/U3buRKlemZ9DnGAevIGn+:cU/d7WRvIPWa4DQFu/U3buRKlemZ9DnG

Score

10^/10

Malware Config

Extracted

Path

C:\ALL YOUR FILES ARE ENCRYPTED.txt

Family

buran

Ransom Note

ALL YOUR FILES ARE ENCRYPTED ***All your data has been compromised. Documents, photos, databases and other important files are encrypted. ***You cannot decipher them yourself! The only method for recovering files is by purchasing a unique private key. Only we can provide you with this key and only we can restore your files. ***The decryption key fee is charged only in bitcoins, we CAN assist in buying bitcoins by giving instructions on how and where to buy. ***In case of non-payment, all data will be put up for auction on the darknet. Beware of data leaks. ***To make sure we have a decryptor and it works, you can send an email to [email protected] or [email protected] and decrypt one not important file for free, DO NOT send files containing databases, any XLS / XML documents for the test. ***Beware of dishonest middlemen. as well as buying a decryption key through intermediaries increases the final cost of the key. ***Do you really want to restore your files? Write to email: [email protected] Your personal ID: 789-C67-E35 Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Emails

[email protected]

Extracted

Path

C:\ALL YOUR FILES ARE ENCRYPTED.txt

Family

buran

Ransom Note

ALL YOUR FILES ARE ENCRYPTED ***All your data has been compromised. Documents, photos, databases and other important files are encrypted. ***You cannot decipher them yourself! The only method for recovering files is by purchasing a unique private key. Only we can provide you with this key and only we can restore your files. ***The decryption key fee is charged only in bitcoins, we CAN assist in buying bitcoins by giving instructions on how and where to buy. ***In case of non-payment, all data will be put up for auction on the darknet. Beware of data leaks. ***To make sure we have a decryptor and it works, you can send an email to [email protected] or [email protected] and decrypt one not important file for free, DO NOT send files containing databases, any XLS / XML documents for the test. ***Beware of dishonest middlemen. as well as buying a decryption key through intermediaries increases the final cost of the key. ***Do you really want to restore your files? Write to email: [email protected] Your personal ID: 13B-682-4D8 Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Emails

[email protected]

Targets

- Target
  
  6a4c8a0b7622b3621900bf47acb16725c4a8dafde394f2bf2bf7112bd90a3408
- Size
  
  215KB
- MD5
  
  e71825acc5c0dbf948ec73b12c397a23
- SHA1
  
  efe7521f2f6f06840418ca99b57989ec7dd797c5
- SHA256
  
  6a4c8a0b7622b3621900bf47acb16725c4a8dafde394f2bf2bf7112bd90a3408
- SHA512
  
  c9369d2a89f54250149b3a92d1d12b2f1a38fcf76e961d08f5ea4c3aec29bc338d8d5113df0bdd35aed5ff2d4c2d71ac3195e27d72489d9275553833314d7fe5
- SSDEEP
  
  6144:cyJE1yd7WEJmcyf70PWna4DQFu/U3buRKlemZ9DnGAevIGn+:cU/d7WRvIPWa4DQFu/U3buRKlemZ9DnG
Score

10^/10

buran ransomware
- Buran
  Ransomware-as-a-service based on the VegaLocker family first identified in 2019.
  ransomware buran
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Deletes itself
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2