zeppelin | c367db84b024c1ca76cf66b046acad61c5a8d79398e8aba1a7f18af60eb38dc0

General

Target

2025-02-12_2429157f5f912cf24d894658961686e8_zeppelin
Size

218KB
Sample

250212-rq4mhavqaw
MD5

2429157f5f912cf24d894658961686e8
SHA1

e2a06afcaaa6962166d829207d3bff3bfc699d05
SHA256

c367db84b024c1ca76cf66b046acad61c5a8d79398e8aba1a7f18af60eb38dc0
SHA512

6782ce79484bcea4c931df2bee0903c96cace844de5726e78823e60a42310901985a75cdec70c81aa3ca130429b09f5163289e2ee6abd16aea17423d8ecfbadd
SSDEEP

6144:HC61i972rJmciP98f2H64DQFu/U3buRKlemZ9DnGAe/IxU+:HK972I/Gf2a4DQFu/U3buRKlemZ9DnGu

Score

10^/10

Malware Config

Extracted

Path

C:\$Recycle.Bin\HOW_TO_RECOVER_DATA.hta

Ransom Note

<html> <head> <style> body { background-color: #000000 } </style> <title>ORCA HELP</title> </head> <body> <h1 style="margin: 7px 352px; color: Crimson"><strong>🔒 YOUR FILES HAVE BEEN ENCRYPTED 🔒</strong></h1> <h2 style="margin: 7px 464px; color: Wheat">Your ID to decrypt: <font color="white">899-710-994</font></h2> <h2 style="margin: 20px 270px; color: Wheat"> Contact us: <font color="Goldenrod">[email protected]</font> | <font color="Goldenrod">[email protected]</font> </h2> <center><div style="color: SkyBlue; width: 70%; height: 50px; border:2px solid; margin:auto"></center> <div style="font-size: 18px; color: red; margin: 3px 0px 3px 6px">Unfortunately for you, due to a serious vulnerability in IT security, you are vulnerable to attacks!<br /> To decrypt files, you need to get a private key.<br /> The only copy of the secret key that can be used to decrypt files is on a private server.<br /> The server will destroy the key within <font color="white">72h</font> after the encryption is completed.<br /> To save the key for a longer period, you can contact us and provide your ID!</div></div> <div style="margin: 5px 0px;"></div> <center><div style="color: SkyBlue; width: 70%; height: 50px; border:2px solid; margin:auto"></center> <div style="font-size: 18px; color: red; margin: 3px 0px 3px 6px">In addition, we collect strictly confidential/personal data.<br /> This data is also stored on a private server.<br /> Your data will be deleted only after payment!<br /> If you decide not to pay, we will publish your data to everyone or resellers.<br /> So you can expect your data to become publicly available in the near future!</div></div> <div style="font-size: 20px; color: LemonChiffon; margin: 20px 30px 0px 220px"> It's just a business and we only care about making a profit!<br /> The only way to get your files back is to contact us for further instructions!<br /> <strong>To establish a trust relationship, you can send 1 file for test decryption (no more than 5 MB)</strong> <div</div> <h1 style="margin: 7px 353px; color: Yellow"><strong>&dArr; &dArr; &dArr; &dArr; &dArr; &dArr; &dArr; &dArr;</strong></h1> <ul style="list-style-type: square; color: Tomato; margin: 5px 17px 1px 17px"> <li>Do not waste your time searching for other decryption methods - THERE ARE NONE, you will pay more for your time!</li> <li>Every day the price of decryption increases!</li> <li>Do not rename encrypted files.</li> <li>Do not use third-party programs to decrypt files - they can only do harm!</li> <li>After payment, you get a decoder (.exe), you only need to run it, and it will do everything by itself.</li> <li>I only accept Bitcoins! You can learn how to buy them on the Internet.</li> </ul> </ul> </body> </html>

Emails

color="Goldenrod">[email protected]</font>

Extracted

Path

C:\$Recycle.Bin\HOW_TO_RECOVER_DATA.hta

Ransom Note

<html> <head> <style> body { background-color: #000000 } </style> <title>ORCA HELP</title> </head> <body> <h1 style="margin: 7px 352px; color: Crimson"><strong>🔒 YOUR FILES HAVE BEEN ENCRYPTED 🔒</strong></h1> <h2 style="margin: 7px 464px; color: Wheat">Your ID to decrypt: <font color="white">888-5E6-65D</font></h2> <h2 style="margin: 20px 270px; color: Wheat"> Contact us: <font color="Goldenrod">[email protected]</font> | <font color="Goldenrod">[email protected]</font> </h2> <center><div style="color: SkyBlue; width: 70%; height: 50px; border:2px solid; margin:auto"></center> <div style="font-size: 18px; color: red; margin: 3px 0px 3px 6px">Unfortunately for you, due to a serious vulnerability in IT security, you are vulnerable to attacks!<br /> To decrypt files, you need to get a private key.<br /> The only copy of the secret key that can be used to decrypt files is on a private server.<br /> The server will destroy the key within <font color="white">72h</font> after the encryption is completed.<br /> To save the key for a longer period, you can contact us and provide your ID!</div></div> <div style="margin: 5px 0px;"></div> <center><div style="color: SkyBlue; width: 70%; height: 50px; border:2px solid; margin:auto"></center> <div style="font-size: 18px; color: red; margin: 3px 0px 3px 6px">In addition, we collect strictly confidential/personal data.<br /> This data is also stored on a private server.<br /> Your data will be deleted only after payment!<br /> If you decide not to pay, we will publish your data to everyone or resellers.<br /> So you can expect your data to become publicly available in the near future!</div></div> <div style="font-size: 20px; color: LemonChiffon; margin: 20px 30px 0px 220px"> It's just a business and we only care about making a profit!<br /> The only way to get your files back is to contact us for further instructions!<br /> <strong>To establish a trust relationship, you can send 1 file for test decryption (no more than 5 MB)</strong> <div</div> <h1 style="margin: 7px 353px; color: Yellow"><strong>&dArr; &dArr; &dArr; &dArr; &dArr; &dArr; &dArr; &dArr;</strong></h1> <ul style="list-style-type: square; color: Tomato; margin: 5px 17px 1px 17px"> <li>Do not waste your time searching for other decryption methods - THERE ARE NONE, you will pay more for your time!</li> <li>Every day the price of decryption increases!</li> <li>Do not rename encrypted files.</li> <li>Do not use third-party programs to decrypt files - they can only do harm!</li> <li>After payment, you get a decoder (.exe), you only need to run it, and it will do everything by itself.</li> <li>I only accept Bitcoins! You can learn how to buy them on the Internet.</li> </ul> </ul> </body> </html>

Emails

color="Goldenrod">[email protected]</font>

Targets

- Target
  
  2025-02-12_2429157f5f912cf24d894658961686e8_zeppelin
- Size
  
  218KB
- MD5
  
  2429157f5f912cf24d894658961686e8
- SHA1
  
  e2a06afcaaa6962166d829207d3bff3bfc699d05
- SHA256
  
  c367db84b024c1ca76cf66b046acad61c5a8d79398e8aba1a7f18af60eb38dc0
- SHA512
  
  6782ce79484bcea4c931df2bee0903c96cace844de5726e78823e60a42310901985a75cdec70c81aa3ca130429b09f5163289e2ee6abd16aea17423d8ecfbadd
- SSDEEP
  
  6144:HC61i972rJmciP98f2H64DQFu/U3buRKlemZ9DnGAe/IxU+:HK972I/Gf2a4DQFu/U3buRKlemZ9DnGu
Score

10^/10

zeppelin defense_evasion discovery execution impact persistence ransomware
- Detects Zeppelin payload
- Zeppelin Ransomware
  Ransomware-as-a-service (RaaS) written in Delphi and first seen in 2019.
  ransomware zeppelin
- Zeppelin family
  zeppelin
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Renames multiple (7402) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2