General

  • Target

    0ef3f837880e58131bb45566215d60ee1c023ce5d0299c05e3b80a2ed931e501.exe

  • Size

    215KB

  • Sample

    221202-pvmtface2t

  • MD5

    a58d761d66e5045c1b5d10b823b90afe

  • SHA1

    1fd48eabec99f127231deab1c36abd640e93f226

  • SHA256

    0ef3f837880e58131bb45566215d60ee1c023ce5d0299c05e3b80a2ed931e501

  • SHA512

    4ff1a1229c6bbb1a54e52d79486cbb66b4d62ee56d5161b96805dd5f2e386100db3cc49245e32aab7a0b2e0542cc1d6c96e42fe9c7f982fa70aef7b1f7d2a94e

  • SSDEEP

    6144:PyJE1yd7WEJmcyf70PWna4DQFu/U3buRKlemZ9DnGAevIX+:PU/d7WRvIPWa4DQFu/U3buRKlemZ9DnI

Malware Config

Extracted

Path

C:\ALL YOUR FILES ARE ENCRYPTED.txt

Family

buran

Ransom Note
ALL YOUR FILES ARE ENCRYPTED ***All your data has been compromised. Documents, photos, databases and other important files are encrypted. ***You cannot decipher them yourself! The only method for recovering files is by purchasing a unique private key. Only we can provide you with this key and only we can restore your files. ***The decryption key fee is charged only in bitcoins, we CAN assist in buying bitcoins by giving instructions on how and where to buy. ***In case of non-payment, all data will be put up for auction on the darknet. Beware of data leaks. ***To make sure we have a decryptor and it works, you can send an email to buybackdate@nuke.africa or buybackdate@nuke.africa and decrypt one not important file for free, DO NOT send files containing databases, any XLS / XML documents for the test. ***Beware of dishonest middlemen. as well as buying a decryption key through intermediaries increases the final cost of the key. ***Do you really want to restore your files? Write to email: buybackdate@nuke.africa Your personal ID: 1E2-1AF-72A Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.
Emails

buybackdate@nuke.africa

Targets

    • Target

      0ef3f837880e58131bb45566215d60ee1c023ce5d0299c05e3b80a2ed931e501.exe

    • Size

      215KB

    • MD5

      a58d761d66e5045c1b5d10b823b90afe

    • SHA1

      1fd48eabec99f127231deab1c36abd640e93f226

    • SHA256

      0ef3f837880e58131bb45566215d60ee1c023ce5d0299c05e3b80a2ed931e501

    • SHA512

      4ff1a1229c6bbb1a54e52d79486cbb66b4d62ee56d5161b96805dd5f2e386100db3cc49245e32aab7a0b2e0542cc1d6c96e42fe9c7f982fa70aef7b1f7d2a94e

    • SSDEEP

      6144:PyJE1yd7WEJmcyf70PWna4DQFu/U3buRKlemZ9DnGAevIX+:PU/d7WRvIPWa4DQFu/U3buRKlemZ9DnI

    Score
    10/10
    • Buran

      Ransomware-as-a-service based on the VegaLocker family first identified in 2019.

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

File Deletion

2
T1107

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Impact

Inhibit System Recovery

2
T1490

Tasks