zeppelin | 30daceda77b644a07bcfbea55b70a83befcb21e384f6d737d77f4002acd9a381

General

Target

33.exe
Size

216KB
Sample

230722-zcys4ace2y
MD5

efb32ebb95f9a07cfa9d404c860b5c2e
SHA1

d79bd759ed3a8db25c32e9813f76f8a5742c19c9
SHA256

30daceda77b644a07bcfbea55b70a83befcb21e384f6d737d77f4002acd9a381
SHA512

b07f13c5717c525ca0663f702028656c9798814f6f06f38e147715916085e81a42a7041927c3f6886fa060146601d7f9b337fabf91e28f2d63b20986faba3611
SSDEEP

6144:UyJE1yd7WWlJmcyfwAPWna4DQFu/U3buRKlemZ9DnGAevIG+C+:UU/d7WWKvhPWa4DQFu/U3buRKlemZ9Db

Score

10^/10

Malware Config

Extracted

Path

C:\$Recycle.Bin\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT

Ransom Note

ALL YOUR FILES HAVE BEEN ENCRYPTED BY "VICE SOCIETY" All your important documents, photos, databases were stolen and encrypted. If you don't contact us in 7 days we will upload your files to darknet! The only method of recovering files is to purchase an unique private key. We are the only who can give you tool to recover your files. To proove that we have the key and it works you can send us 2 files and we decrypt it for free (not more than 2 MB each). This file should be not valuable! Write to email: [email protected] Reserved email: [email protected] Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to ours) or you can become a victim of a scam.

Emails

[email protected]

Targets

- Target
  
  33.exe
- Size
  
  216KB
- MD5
  
  efb32ebb95f9a07cfa9d404c860b5c2e
- SHA1
  
  d79bd759ed3a8db25c32e9813f76f8a5742c19c9
- SHA256
  
  30daceda77b644a07bcfbea55b70a83befcb21e384f6d737d77f4002acd9a381
- SHA512
  
  b07f13c5717c525ca0663f702028656c9798814f6f06f38e147715916085e81a42a7041927c3f6886fa060146601d7f9b337fabf91e28f2d63b20986faba3611
- SSDEEP
  
  6144:UyJE1yd7WWlJmcyfwAPWna4DQFu/U3buRKlemZ9DnGAevIG+C+:UU/d7WWKvhPWa4DQFu/U3buRKlemZ9Db
Score

10^/10

zeppelin persistence ransomware
- Detects Zeppelin payload
- Zeppelin Ransomware
  Ransomware-as-a-service (RaaS) written in Delphi and first seen in 2019.
  ransomware zeppelin
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Renames multiple (4446) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Renames multiple (7308) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2