buran

General

Target

2024-04-12_eebfab07abcb75f2aa1821a4efcf7cfd_zeppelin
Size

210KB
Sample

240413-amf9csbf3x
MD5

eebfab07abcb75f2aa1821a4efcf7cfd
SHA1

2e2c0667215777d5a0f5e0972af6cf5418febeb1
SHA256

83739dc8c9f8430b1a8ade85e926bf8084942759cd1d4e502c1960ce02e93d5b
SHA512

ac22326f0c365b14b16e3c942a2424d60cb7b1431ece875a3247b0771da3bdb2e7b86bf1ae2bbb3506dfb82f687f1c4d8f51bc0b788f7e919f802c496eef454a
SSDEEP

6144:Ria1vcaEre+HPsKSAzG44DQFu/U3buRKlemZ9DnGAeWBJR1+W:RHcthvzSAx4DQFu/U3buRKlemZ9DnGAL

Score

10^/10

Malware Config

Extracted

Path

C:\Program Files\Java\jdk1.7.0_80\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT

Family

buran

Ransom Note

!!! ALL YOUR FILES ARE ENCRYPTED !!! All your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. To be sure we have the decryptor and it works you can send an email: puljaipopre1981@protonmail.com and decrypt one file for free. But this file should be of not valuable! Do you really want to restore your files? Write to email: puljaipopre1981@protonmail.com Reserved email: viomukinam1978@protonmail.com Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Emails

puljaipopre1981@protonmail.com

viomukinam1978@protonmail.com

Targets

- Target
  
  2024-04-12_eebfab07abcb75f2aa1821a4efcf7cfd_zeppelin
- Size
  
  210KB
- MD5
  
  eebfab07abcb75f2aa1821a4efcf7cfd
- SHA1
  
  2e2c0667215777d5a0f5e0972af6cf5418febeb1
- SHA256
  
  83739dc8c9f8430b1a8ade85e926bf8084942759cd1d4e502c1960ce02e93d5b
- SHA512
  
  ac22326f0c365b14b16e3c942a2424d60cb7b1431ece875a3247b0771da3bdb2e7b86bf1ae2bbb3506dfb82f687f1c4d8f51bc0b788f7e919f802c496eef454a
- SSDEEP
  
  6144:Ria1vcaEre+HPsKSAzG44DQFu/U3buRKlemZ9DnGAeWBJR1+W:RHcthvzSAx4DQFu/U3buRKlemZ9DnGAL
Score

10^/10

buran zeppelin persistence ransomware
- Buran
  Ransomware-as-a-service based on the VegaLocker family first identified in 2019.
  ransomware buran
- Detects Zeppelin payload
- Zeppelin Ransomware
  Ransomware-as-a-service (RaaS) written in Delphi and first seen in 2019.
  ransomware zeppelin
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Renames multiple (7380) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2