zeppelin | b8355b2216b7bb60a7d421a57de257fd251f0f7a20c861bf91693233117e5f2d

General

Target

2023-07-15_3882feced4dec87fbf8780c44d15ea5e_zeppelin
Size

225KB
Sample

230724-p4h7lsdg5y
MD5

3882feced4dec87fbf8780c44d15ea5e
SHA1

b6b92728e0a0fb2d95bec468709c11c4c2faf9f4
SHA256

b8355b2216b7bb60a7d421a57de257fd251f0f7a20c861bf91693233117e5f2d
SHA512

9d0703bbe3aadc8bd88a4153c7b7f45dd5c599e45fa78b1c50576701497b86021bb87cb3a197883ca9e5973f08f3fa3ece75302d655eecb07355efee8b15f44d
SSDEEP

6144:YSK1AqRHi/EXtw+apQ3an64DQFu/U3buRKlemZ9DnGAeOhoHwN+c:YosHiGWRpQb4DQFu/U3buRKlemZ9DnGm

Score

10^/10

Malware Config

Extracted

Path

C:\Program Files\Java\jdk1.7.0_80\!!! YOUR FILES HAVE BEEN ENCRYPTED !!!.TXT

Ransom Note

!!! YOUR FILES HAVE BEEN ENCRYPTED !!! All your files, including documents, databases, and other crucial data, have been encrypted. I've uploaded some databases and important files from your computers to the cloud. You have 48 hours to get in touch with us and reach an agreement. If you don't contact us by the end of this period, I'll release your data publicly on the dark web. This could damage your company and your partners. We're the only ones capable of restoring your files. To prove that we have a functional decryption tool, we're offering you the chance to decrypt one file for free. You can reach out to us through an anonymous chat. Just follow the provided instructions. 1. Visit https://tox.chat/download.html 2. Download and install qTox on your computer. 3. Open it, click "New Profile," and create a new profile. 4. Press the + "Add to friends" button and enter my TOX ID DBA5908245E3067FDA9B0C0D6FEEADC3D3C965A29AC340CA14D539924700DC53948D5F860D7D 5. Click "Send friend request." 6. Keep qTox open and wait. In a few hours, I'll accept your request, and we can begin communicating. Your personal ID: B82-CAE-6A6

URLs

https://tox.chat/download.html

Targets

- Target
  
  2023-07-15_3882feced4dec87fbf8780c44d15ea5e_zeppelin
- Size
  
  225KB
- MD5
  
  3882feced4dec87fbf8780c44d15ea5e
- SHA1
  
  b6b92728e0a0fb2d95bec468709c11c4c2faf9f4
- SHA256
  
  b8355b2216b7bb60a7d421a57de257fd251f0f7a20c861bf91693233117e5f2d
- SHA512
  
  9d0703bbe3aadc8bd88a4153c7b7f45dd5c599e45fa78b1c50576701497b86021bb87cb3a197883ca9e5973f08f3fa3ece75302d655eecb07355efee8b15f44d
- SSDEEP
  
  6144:YSK1AqRHi/EXtw+apQ3an64DQFu/U3buRKlemZ9DnGAeOhoHwN+c:YosHiGWRpQb4DQFu/U3buRKlemZ9DnGm
Score

10^/10

zeppelin evasion ransomware
- Detects Zeppelin payload
- Zeppelin Ransomware
  Ransomware-as-a-service (RaaS) written in Delphi and first seen in 2019.
  ransomware zeppelin
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Renames multiple (2985) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Renames multiple (7443) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Stops running service(s)
  evasion
- Deletes itself
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2