zeppelin | 24efa10a2b51c5fd6e45da6babd4e797d9cae399be98941f950abf7b5e9a4cd7

General

Target

4aa0fef7356c18214f9c9bb3a9ea16cd.bin
Size

216KB
Sample

221208-j7q4qshd49
MD5

4aa0fef7356c18214f9c9bb3a9ea16cd
SHA1

92e655dbe599a3ecfc9c8f510ccc03f81185f660
SHA256

24efa10a2b51c5fd6e45da6babd4e797d9cae399be98941f950abf7b5e9a4cd7
SHA512

2c0cb5a6ecac3dde2fea800fdbb53f13f7b057216487cd9889218f7cf63b4b98cd6c3ba4cd1866d8cf9ed52b0a5b8a0da971566fa4e26ecebf119da1048f9c10
SSDEEP

6144:uyJE1yd7WWlJmcyfwAPWna4DQFu/U3buRKlemZ9DnGAevIGcF7+:uU/d7WWKvhPWa4DQFu/U3buRKlemZ9Dh

Score

10^/10

Malware Config

Extracted

Path

C:\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT

Ransom Note

ALL YOUR FILES HAVE BEEN ENCRYPTED BY "VICE SOCIETY" All your important documents, photos, databases were stolen and encrypted. If you don't contact us in 7 days we will upload your files to darknet. The only method of recovering files is to purchase an unique private key. We are the only who can give you tool to recover your files. To proove that we have the key and it works you can send us 2 files and we decrypt it for free (not more than 2 MB each). This file should be not valuable! Write to email: [email protected] Alternative email: [email protected] Public emai:l [email protected] Our tor website: vsociethok6sbprvevl4dlwbqrzyhxcxaqpvcqt5belwvsuxaxsutyad.onion Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to ours) or you can become a victim of a scam.

Emails

[email protected]

URLs

http://vsociethok6sbprvevl4dlwbqrzyhxcxaqpvcqt5belwvsuxaxsutyad.onion

Targets

- Target
  
  4aa0fef7356c18214f9c9bb3a9ea16cd.bin
- Size
  
  216KB
- MD5
  
  4aa0fef7356c18214f9c9bb3a9ea16cd
- SHA1
  
  92e655dbe599a3ecfc9c8f510ccc03f81185f660
- SHA256
  
  24efa10a2b51c5fd6e45da6babd4e797d9cae399be98941f950abf7b5e9a4cd7
- SHA512
  
  2c0cb5a6ecac3dde2fea800fdbb53f13f7b057216487cd9889218f7cf63b4b98cd6c3ba4cd1866d8cf9ed52b0a5b8a0da971566fa4e26ecebf119da1048f9c10
- SSDEEP
  
  6144:uyJE1yd7WWlJmcyfwAPWna4DQFu/U3buRKlemZ9DnGAevIGcF7+:uU/d7WWKvhPWa4DQFu/U3buRKlemZ9Dh
Score

10^/10

zeppelin persistence ransomware
- Detects Zeppelin payload
- Zeppelin Ransomware
  Ransomware-as-a-service (RaaS) written in Delphi and first seen in 2019.
  ransomware zeppelin
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2