buran

General

Target

0ef3f837880e58131bb45566215d60ee1c023ce5d0299c05e3b80a2ed931e501.exe
Size

215KB
Sample

221202-pvmtface2t
MD5

a58d761d66e5045c1b5d10b823b90afe
SHA1

1fd48eabec99f127231deab1c36abd640e93f226
SHA256

0ef3f837880e58131bb45566215d60ee1c023ce5d0299c05e3b80a2ed931e501
SHA512

4ff1a1229c6bbb1a54e52d79486cbb66b4d62ee56d5161b96805dd5f2e386100db3cc49245e32aab7a0b2e0542cc1d6c96e42fe9c7f982fa70aef7b1f7d2a94e
SSDEEP

6144:PyJE1yd7WEJmcyf70PWna4DQFu/U3buRKlemZ9DnGAevIX+:PU/d7WRvIPWa4DQFu/U3buRKlemZ9DnI

Score

10^/10

Malware Config

Extracted

Path

C:\ALL YOUR FILES ARE ENCRYPTED.txt

Family

buran

Ransom Note

ALL YOUR FILES ARE ENCRYPTED ***All your data has been compromised. Documents, photos, databases and other important files are encrypted. ***You cannot decipher them yourself! The only method for recovering files is by purchasing a unique private key. Only we can provide you with this key and only we can restore your files. ***The decryption key fee is charged only in bitcoins, we CAN assist in buying bitcoins by giving instructions on how and where to buy. ***In case of non-payment, all data will be put up for auction on the darknet. Beware of data leaks. ***To make sure we have a decryptor and it works, you can send an email to [email protected] or [email protected] and decrypt one not important file for free, DO NOT send files containing databases, any XLS / XML documents for the test. ***Beware of dishonest middlemen. as well as buying a decryption key through intermediaries increases the final cost of the key. ***Do you really want to restore your files? Write to email: [email protected] Your personal ID: 1E2-1AF-72A Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Emails

[email protected]

Targets

- Target
  
  0ef3f837880e58131bb45566215d60ee1c023ce5d0299c05e3b80a2ed931e501.exe
- Size
  
  215KB
- MD5
  
  a58d761d66e5045c1b5d10b823b90afe
- SHA1
  
  1fd48eabec99f127231deab1c36abd640e93f226
- SHA256
  
  0ef3f837880e58131bb45566215d60ee1c023ce5d0299c05e3b80a2ed931e501
- SHA512
  
  4ff1a1229c6bbb1a54e52d79486cbb66b4d62ee56d5161b96805dd5f2e386100db3cc49245e32aab7a0b2e0542cc1d6c96e42fe9c7f982fa70aef7b1f7d2a94e
- SSDEEP
  
  6144:PyJE1yd7WEJmcyf70PWna4DQFu/U3buRKlemZ9DnGAevIX+:PU/d7WRvIPWa4DQFu/U3buRKlemZ9DnI
Score

10^/10

buran ransomware
- Buran
  Ransomware-as-a-service based on the VegaLocker family first identified in 2019.
  ransomware buran
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2