balaclava | f247ae6db52989c9a598c3c7fbc1ae2db54f5c65be862880e11578b8583731cb

General

Target

f247ae6db52989c9a598c3c7fbc1ae2db54f5c65be862880e11578b8583731cb.bin
Size

212KB
Sample

240608-sqmvesch2s
MD5

723825ad69a5d55a1e5ed3d1ee831f0d
SHA1

7e082df63c3de0f8bf9d38edf72ba5268078275a
SHA256

f247ae6db52989c9a598c3c7fbc1ae2db54f5c65be862880e11578b8583731cb
SHA512

dbd1fd80c8e1224c79ecea419919df3590186c95bfd2f606d6573d759374bc54db8331478207e3b543114431c2ed8eede83b7eca74d4313e7dee16bd527c2c78
SSDEEP

6144:tia1gMH2EXtAup5Qnqn64DQFu/U3buRKlemZ9DnGAe+hsO6a+8:tIMHxGe5Qb4DQFu/U3buRKlemZ9DnGAb

Score

10^/10

Malware Config

Extracted

Path

C:\Program Files\7-Zip\Lang\RECOVERY DATA INFORMATION.TXT

Family

balaclava

Ransom Note

Hello! If you see this message - this means your files are now encrypted and are in a non-working state! Now only we can help you recover. If you are ready to restore the work - send us an email to the address [email protected] In the letter, specify your personal identifier, which you will see below. In the reply letter we will inform you the cost of decrypting your files. Also from your servers files, documents, databases SQL, PDF were uploaded to our cloud storage After we agree, you will receive a decryption program, as well as all your files on our server will be deleted. Otherwise, they will fall into the open access of the Internet! Before payment you can send us 1-2 files for test decryption. We will decrypt the files you requested and send you back. This ensures that we own the key to recover your data. The total file size should be no more than 3 MB, the files should not contain valuable information (databases, backups, large Excel spreadsheets ...). Please be sure that we will find common languge. We will restore all the data. Email to contact us - [email protected] Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. Your personal ID: 304-BAC-7BC

Emails

[email protected]

Targets

- Target
  
  f247ae6db52989c9a598c3c7fbc1ae2db54f5c65be862880e11578b8583731cb.bin
- Size
  
  212KB
- MD5
  
  723825ad69a5d55a1e5ed3d1ee831f0d
- SHA1
  
  7e082df63c3de0f8bf9d38edf72ba5268078275a
- SHA256
  
  f247ae6db52989c9a598c3c7fbc1ae2db54f5c65be862880e11578b8583731cb
- SHA512
  
  dbd1fd80c8e1224c79ecea419919df3590186c95bfd2f606d6573d759374bc54db8331478207e3b543114431c2ed8eede83b7eca74d4313e7dee16bd527c2c78
- SSDEEP
  
  6144:tia1gMH2EXtAup5Qnqn64DQFu/U3buRKlemZ9DnGAe+hsO6a+8:tIMHxGe5Qb4DQFu/U3buRKlemZ9DnGAb
Score

10^/10

zeppelin persistence ransomware balaclava defense_evasion execution impact
- Balaclava Malware
  Balaclava malware is a ransomware program.
  ransomware balaclava
- Detects Zeppelin payload
- Zeppelin Ransomware
  Ransomware-as-a-service (RaaS) written in Delphi and first seen in 2019.
  ransomware zeppelin
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Renames multiple (3439) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2