Overview

overview

10

Static

static

3

1f026c4cbb...0d.exe

windows7-x64

10

1f026c4cbb...0d.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1f026c4cbb2316d51d90d01dc50b531a6f52fa8424ce9b8298f01a3fac1a270d

  • Size

    250KB

  • Sample

    230803-nwsweada69

  • MD5

    8298bea449a626ed8d9cd54d741075a7

  • SHA1

    506c82cfd2d54e3684787aee836645788cf4dca3

  • SHA256

    1f026c4cbb2316d51d90d01dc50b531a6f52fa8424ce9b8298f01a3fac1a270d

  • SHA512

    74b7538a941f9008a84764a4b4e57d05f0b492015fa560fddfcef2a99d0227088300fa26d8b9e9a85f363164793ec9331b32d26044b069c885a5ef5b7ff9d1bd

  • SSDEEP

    6144:PWfM6iKwtADM5njFGKfi/Xm51QCG8VG1XhmIQ4L:+l0LnjFGKf351rGagwhW

Score
10/10
buranzeppelinpersistenceransomware

Malware Config

Extracted

Path

C:\$Recycle.Bin\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT

Family

buran

Ransom Note
!!! ALL YOUR FILES ARE ENCRYPTED !!! All your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. To be sure we have the decryptor and it works you can send an email: kd8eby0@inboxhub.net and decrypt one file for free. But this file should be of not valuable! Do you really want to restore your files? Write to email: kd8eby0@inboxhub.net Reserved email: kd8eby0@onionmail.org Reserved email: kd8eby0@nuke.africa Your personal ID: 6DD-319-AA0 Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.
Emails

kd8eby0@inboxhub.net

kd8eby0@onionmail.org

kd8eby0@nuke.africa

Targets

    • Target

      1f026c4cbb2316d51d90d01dc50b531a6f52fa8424ce9b8298f01a3fac1a270d

    • Size

      250KB

    • MD5

      8298bea449a626ed8d9cd54d741075a7

    • SHA1

      506c82cfd2d54e3684787aee836645788cf4dca3

    • SHA256

      1f026c4cbb2316d51d90d01dc50b531a6f52fa8424ce9b8298f01a3fac1a270d

    • SHA512

      74b7538a941f9008a84764a4b4e57d05f0b492015fa560fddfcef2a99d0227088300fa26d8b9e9a85f363164793ec9331b32d26044b069c885a5ef5b7ff9d1bd

    • SSDEEP

      6144:PWfM6iKwtADM5njFGKfi/Xm51QCG8VG1XhmIQ4L:+l0LnjFGKf351rGagwhW

    Score
    10/10
    buranzeppelinpersistenceransomware

    • Buran

      Ransomware-as-a-service based on the VegaLocker family first identified in 2019.

      ransomwareburan

    • Detects Zeppelin payload

    • Zeppelin Ransomware

      Ransomware-as-a-service (RaaS) written in Delphi and first seen in 2019.

      ransomwarezeppelin

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Renames multiple (7338) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Indicator Removal

2
T1070

File Deletion

2
T1070.004

Modify Registry

2
T1112

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Inhibit System Recovery

2
T1490

Resource Development

Reconnaissance

Tasks