buran

General

Target

caa499836c5e5fae87726b57d63cc554
Size

334KB
Sample

240315-gksmyahe2w
MD5

caa499836c5e5fae87726b57d63cc554
SHA1

7a820dd7549516edbf6f333ff2e4b7a21b63da96
SHA256

cacd10b8c69270ec77d67d8b4d7fc1081ca247200e650f93a2a6e1b9c1c85e37
SHA512

e6c8074aa183e407f3054fc07528576379d1980e97f17e7c4c10673c700a0a2af1354eb7484f9b33bebaa7e7fc04a0bcd2831ba6dcaf62da8c461e2672359b10
SSDEEP

6144:igDsJ4kjHjjB0kATn3+65WffjAS0bBU4T3NY20hqYIyse5z:I6kjHjF0dnO6UXjUBPzNNGqJyLt

Score

10^/10

Malware Config

Extracted

Path

C:\$Recycle.Bin\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT

Family

buran

Ransom Note

!!! ALL YOUR FILES ARE ENCRYPTED !!! All your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. PAY FAST 590$=0.013 btc or the price will increase tomorrow bitcoin address bc1qqxnp9z0ff8x852dyflp5r9r6rzse8jl5hzmqz8 To be sure we have the decryptor and it works you can send an email: [email protected] and decrypt one file for free. But this file should be of not valuable! Do you really want to restore your files? [email protected] TELEGRAM @ payfast290 Your personal ID: 153-CFD-14C Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Extracted

Path

C:\$Recycle.Bin\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT

Family

buran

Ransom Note

!!! ALL YOUR FILES ARE ENCRYPTED !!! All your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. PAY FAST 590$=0.013 btc or the price will increase tomorrow bitcoin address bc1qqxnp9z0ff8x852dyflp5r9r6rzse8jl5hzmqz8 To be sure we have the decryptor and it works you can send an email: [email protected] and decrypt one file for free. But this file should be of not valuable! Do you really want to restore your files? [email protected] TELEGRAM @ payfast290 Your personal ID: 123-8C2-07E Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Targets

- Target
  
  caa499836c5e5fae87726b57d63cc554
- Size
  
  334KB
- MD5
  
  caa499836c5e5fae87726b57d63cc554
- SHA1
  
  7a820dd7549516edbf6f333ff2e4b7a21b63da96
- SHA256
  
  cacd10b8c69270ec77d67d8b4d7fc1081ca247200e650f93a2a6e1b9c1c85e37
- SHA512
  
  e6c8074aa183e407f3054fc07528576379d1980e97f17e7c4c10673c700a0a2af1354eb7484f9b33bebaa7e7fc04a0bcd2831ba6dcaf62da8c461e2672359b10
- SSDEEP
  
  6144:igDsJ4kjHjjB0kATn3+65WffjAS0bBU4T3NY20hqYIyse5z:I6kjHjF0dnO6UXjUBPzNNGqJyLt
Score

10^/10

buran zeppelin persistence ransomware
- Buran
  Ransomware-as-a-service based on the VegaLocker family first identified in 2019.
  ransomware buran
- Detects Zeppelin payload
- Zeppelin Ransomware
  Ransomware-as-a-service (RaaS) written in Delphi and first seen in 2019.
  ransomware zeppelin
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Renames multiple (7357) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2