General

  • Target

    6a4c8a0b7622b3621900bf47acb16725c4a8dafde394f2bf2bf7112bd90a3408.exe

  • Size

    215KB

  • Sample

    221202-py4w5acg9z

  • MD5

    e71825acc5c0dbf948ec73b12c397a23

  • SHA1

    efe7521f2f6f06840418ca99b57989ec7dd797c5

  • SHA256

    6a4c8a0b7622b3621900bf47acb16725c4a8dafde394f2bf2bf7112bd90a3408

  • SHA512

    c9369d2a89f54250149b3a92d1d12b2f1a38fcf76e961d08f5ea4c3aec29bc338d8d5113df0bdd35aed5ff2d4c2d71ac3195e27d72489d9275553833314d7fe5

  • SSDEEP

    6144:cyJE1yd7WEJmcyf70PWna4DQFu/U3buRKlemZ9DnGAevIGn+:cU/d7WRvIPWa4DQFu/U3buRKlemZ9DnG

Malware Config

Extracted

Path

C:\ALL YOUR FILES ARE ENCRYPTED.txt

Family

buran

Ransom Note
ALL YOUR FILES ARE ENCRYPTED ***All your data has been compromised. Documents, photos, databases and other important files are encrypted. ***You cannot decipher them yourself! The only method for recovering files is by purchasing a unique private key. Only we can provide you with this key and only we can restore your files. ***The decryption key fee is charged only in bitcoins, we CAN assist in buying bitcoins by giving instructions on how and where to buy. ***In case of non-payment, all data will be put up for auction on the darknet. Beware of data leaks. ***To make sure we have a decryptor and it works, you can send an email to venolockdate1@rape.lol or venolockdate1@rape.lol and decrypt one not important file for free, DO NOT send files containing databases, any XLS / XML documents for the test. ***Beware of dishonest middlemen. as well as buying a decryption key through intermediaries increases the final cost of the key. ***Do you really want to restore your files? Write to email: venolockdate1@rape.lol Your personal ID: 6B2-BA1-09F Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.
Emails

venolockdate1@rape.lol

Targets

    • Target

      6a4c8a0b7622b3621900bf47acb16725c4a8dafde394f2bf2bf7112bd90a3408.exe

    • Size

      215KB

    • MD5

      e71825acc5c0dbf948ec73b12c397a23

    • SHA1

      efe7521f2f6f06840418ca99b57989ec7dd797c5

    • SHA256

      6a4c8a0b7622b3621900bf47acb16725c4a8dafde394f2bf2bf7112bd90a3408

    • SHA512

      c9369d2a89f54250149b3a92d1d12b2f1a38fcf76e961d08f5ea4c3aec29bc338d8d5113df0bdd35aed5ff2d4c2d71ac3195e27d72489d9275553833314d7fe5

    • SSDEEP

      6144:cyJE1yd7WEJmcyf70PWna4DQFu/U3buRKlemZ9DnGAevIGn+:cU/d7WRvIPWa4DQFu/U3buRKlemZ9DnG

    Score
    10/10
    • Buran

      Ransomware-as-a-service based on the VegaLocker family first identified in 2019.

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

File Deletion

2
T1107

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Impact

Inhibit System Recovery

2
T1490

Tasks