Overview

overview

10

Static

static

10

442bf867c8...24.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    442bf867c8738c7231ff09db0715ec79d0ae15c050fbd46946c45b76a040d024.7z
  • Size 91KB
  • Sample240718-vwxypaydkm
  • SHA256 9c49b8cd781dbb67a14859e7024f137537780a599beb1ce710e6880c8221aa0f
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
buranzeppelindefense_evasionexecutionimpactransomware

Malware Config

Extracted

Path

  • C:\Program Files\Crashpad\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT

  • buran

Ransom Note
  • !!! ALL YOUR FILES ARE ENCRYPTED !!! All your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. To be sure we have the decryptor and it works you can send an email: [email protected] and decrypt one file for free. But this file should be of not valuable! Do you really want to restore your files? Write to email: [email protected] Reserved email: [email protected] Your personal ID: 147-752-85E Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Targets

    • Target
      442bf867c8738c7231ff09db0715ec79d0ae15c050fbd46946c45b76a040d024.exe
    • Size 214KB
    • SHA256 442bf867c8738c7231ff09db0715ec79d0ae15c050fbd46946c45b76a040d024
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    buranzeppelindefense_evasionexecutionimpactransomware

    • Buran

      Ransomware-as-a-service based on the VegaLocker family first identified in 2019.

      ransomwareburan

    • Detects Zeppelin payload

    • Zeppelin Ransomware

      Ransomware-as-a-service (RaaS) written in Delphi and first seen in 2019.

      ransomwarezeppelin

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Renames multiple (6050) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Deletes itself

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks