Resubmissions
25/03/2025, 15:11
250325-skmbpsxzaw1025/03/2025, 15:06
250325-sg1d6a1px21025/03/2025, 15:01
250325-sd5jpsxyct1025/03/2025, 14:56
250325-sbdcfaxxgs1025/03/2025, 14:50
250325-r7ve6a1nv31025/03/2025, 14:46
250325-r5ab7sxwhx1025/03/2025, 14:40
250325-r2c9paxwe11005/02/2025, 10:25
250205-mgcefaslhw1005/02/2025, 10:17
250205-mbs51atmbk1005/02/2025, 09:15
250205-k785zs1pfn10General
- Target RS.7z
- Size 20.5MB
- Sample250325-sg1d6a1px2
- SHA256 c5741701b3866459dd1ffa2477cfd8776713612912693a5897f78aac795d23e9
Malware Config
Extracted
-
blackmatter
-
1.2
-
512478c08dada2af19e49808fbda5b0b
-
Username
-
Password
120Heisler
-
Username
-
Password
Tesla2019
-
Username
-
Password
iteam8**
-
https://paymenthacks.com
-
http://paymenthacks.com
-
https://mojobiden.com
-
http://mojobiden.com
-
attempt_auth
true
-
create_mutex
true
-
encrypt_network_shares
true
-
exfiltrate
true
-
mount_volumes
true
Extracted
-
mespinoza
-
ransomnote
Hi Company, Every byte on any types of your devices was encrypted. Don't try to use backups because it were encrypted too. To get all your data back contact us: [email protected] [email protected] [email protected] Also, be aware that we downloaded files from your servers and in case of non-payment we will be forced to upload them on our website, and if necessary, we will sell them on the darknet. Check out our website, we just posted there new updates for our partners: http://wqmfzni2nvbbpk25.onion/ -------------- FAQ: 1. Q: How can I make sure you don't fooling me? A: You can send us 2 files(max 2mb). 2. Q: What to do to get all data back? A: Don't restart the computer, don't move files and write us. 3. Q: What to tell my boss? A: Protect Your System Amigo.
Extracted
-
sodinokibi
-
$2a$10$kmb3nsvQXC.93GYNCGKy/uq9hYHivf0e3HcajFIifr8Hf3fmnofgm
-
7258
-
gasbarre.com
-
all-turtles.com
-
rksbusiness.com
-
christ-michael.net
-
mardenherefordshire-pc.gov.uk
-
erstatningsadvokaterne.dk
-
marchand-sloboda.com
-
unim.su
-
bauertree.com
-
faronics.com
-
moveonnews.com
-
autopfand24.de
-
mountsoul.de
-
beaconhealthsystem.org
-
cerebralforce.net
-
aprepol.com
-
kaotikkustomz.com
-
dubnew.com
-
simulatebrain.com
-
alvinschwartz.wordpress.com
-
net
true
-
pid
$2a$10$kmb3nsvQXC.93GYNCGKy/uq9hYHivf0e3HcajFIifr8Hf3fmnofgm
-
prc
outlook
agntsvc
infopath
sqbcoreservice
steam
firefox
ocomm
ocssd
mydesktopqos
oracle
powerpnt
wordpad
synctime
sql
thebat
onenote
excel
visio
encsvc
winword
mydesktopservice
dbsnmp
isqlplussvc
tbirdconfig
mspub
msaccess
thunderbird
ocautoupds
xfssvccon
dbeng50
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] Data leak [+] First of all we have uploaded more then 70 GB archived data from your file server and SQL server Example of data: - Accounting - Finance - Personal Data - Banking data - Confidential files And more other... Our blog: http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/ Read what happens to those who do not pay. We are ready: - To provide you the evidence of stolen data - To give you universal decrypting tool for all encrypted files. - To delete all the stolen data. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
7258
-
svc
svc$
vss
sophos
mepocs
backup
sql
memtas
veeam
Extracted
-
sodinokibi
-
$2a$10$dfjpLrXuDytfF.kmYtQ1ROgsXjTJEe8EmQT65ftxlTpJtXPZrhsAq
-
7178
-
kamahouse.net
-
bridgeloanslenders.com
-
abitur-undwieweiter.de
-
live-your-life.jp
-
xn--rumung-bua.online
-
anteniti.com
-
marcuswhitten.site
-
ostheimer.at
-
joseconstela.com
-
deepsouthclothingcompany.com
-
dr-seleznev.com
-
ecpmedia.vn
-
aunexis.ch
-
anthonystreetrimming.com
-
pocket-opera.de
-
mooreslawngarden.com
-
osterberg.fi
-
extraordinaryoutdoors.com
-
kamienny-dywan24.pl
-
fitovitaforum.com
-
net
false
-
pid
$2a$10$dfjpLrXuDytfF.kmYtQ1ROgsXjTJEe8EmQT65ftxlTpJtXPZrhsAq
-
prc
avgadmsv
BackupUpdater
ocautoupds
synctime
thebat
excel
isqlplussvc
ccSetMgr
SPBBCSvc
Sage.NA.AT_AU.SysTray
lmibackupvssservice
CarboniteUI
powerpnt
BackupMaint
onenote
klnagent
sql
Rtvscan
xfssvccon
Smc
mspub
encsvc
LogmeInBackupService
kavfsscs
ccSvcHst
BackupExtender
NSCTOP
outlook
dbsnmp
mydesktopservice
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] Attention!!! [+] Also your private data was downloaded. We will publish it in case you will not get in touch with us asap. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
7178
-
svc
ssistelemetry
adsync
svc$
msseces
mbamservice
ssastelemetry
altaro
sbamsvc
ds_notifier
ntrtscan
ofcservice
code42service
macmnsvc
memtas
auservice
telemetryserver
tmccsf
psqlwge
sppsvc
viprepplsvc
azurea
ds_monitor
swi_filter
protectedstorage
mfemms
mfevtp
kaseyaagentendpoint
ltservice
dssvc
altiback
Extracted
-
C:\Program Files\7-Zip\Lang\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT
-
buran
- !!! ALL YOUR FILES ARE ENCRYPTED !!! All your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. To be sure we have the decryptor and it works you can send an email: [email protected] and decrypt one file for free. But this file should be of not valuable! Do you really want to restore your files? Write to email: [email protected] Reserved email: [email protected] Your personal ID: FD5-D41-F76 Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.
Extracted
-
C:\Program Files\Java\jdk1.7.0_80\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT
-
buran
- !!! ALL YOUR FILES ARE ENCRYPTED !!! All your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. To be sure we have the decryptor and it works you can send an email: [email protected] and decrypt one file for free. But this file should be of not valuable! Do you really want to restore your files? Write to email: [email protected] Reserved email: [email protected] Your personal ID: 827-632-397 Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.
Extracted
-
C:\Program Files\7-Zip\Lang\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT
-
buran
- !!! ALL YOUR FILES ARE ENCRYPTED !!! All your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. To be sure we have the decryptor and it works you can send an email: [email protected] and decrypt one file for free. But this file should be of not valuable! Do you really want to restore your files? Write to email: [email protected] Reserved email: [email protected] Your personal ID: FDE-C1A-44C Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.
Extracted
-
C:\Program Files\7-Zip\Lang\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT
-
buran
- !!! ALL YOUR FILES ARE ENCRYPTED !!! All your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. To be sure we have the decryptor and it works you can send an email: [email protected] and decrypt one file for free. But this file should be of not valuable! Do you really want to restore your files? Write to email: [email protected] Reserved email: [email protected] Your personal ID: 186-544-3C6 Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.
Extracted
-
C:\Program Files\7-Zip\Lang\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT
-
buran
- !!! ALL YOUR FILES ARE ENCRYPTED !!! All your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. To be sure we have the decryptor and it works you can send an email: [email protected] and decrypt one file for free. But this file should be of not valuable! Do you really want to restore your files? Write to email: [email protected] Reserved email: [email protected] Your personal ID: 2AE-91A-248 Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.
Targets
-
- Target RansomwareSamples/AidaCryst.PNG
- Size 138KB
- SHA256 1890f53fbdef149f294a8362898d62431f2c3100e36154ee3d884a68e6f89429
Score1/10 -
- Target 0xfff.pyc
- Size 12KB
- SHA256 fbc5264b62faf5d27fb962dfbd48ca54f2c7e7a18ca2892e6640030b5388bce3
Score1/10 -
- Target out.upx
- Size 59KB
- SHA256 adfd80323fa60aab36f3217f37580b462168bc414e65deebd5b2609d22b826a2
Score3/10 -
- Target out.upx
- Size 40KB
- SHA256 c1bac7436253ca3e66f36dfdbc1f237cf4c6bc0cf7f2dec5dd9ed9611d16191f
Score3/10 -
- Target RansomwareSamples/Thanos_23_03_2021_91KB.exe
- Size 91KB
- SHA256 8a4a038a965ba42a0442d44abf25e4d21f5049d4a4a8aa9cb6691ec4282814a1
Score10/10-
Disables service(s)
-
Renames multiple (79) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Drops startup file
-
Modifies file permissions
-
Network Share Discovery
Attempt to gather information on host network.
-
- Target RansomwareSamples/Zeppelin_08_03_2021_813KB.exe
- Size 812KB
- SHA256 b7f96fbb9844cac5c7f4ec966683f3564bbb9a2f453927e1c579dcb0154f5f83
Score10/10-
Buran
Ransomware-as-a-service based on the VegaLocker family first identified in 2019.
-
Buran family
-
Detects Zeppelin payload
-
Zeppelin Ransomware
Ransomware-as-a-service (RaaS) written in Delphi and first seen in 2019.
-
Zeppelin family
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (6099) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
MITRE ATT&CK Enterprise v15
Execution
System Services
1Service Execution
1Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Direct Volume Access
1File and Directory Permissions Modification
1Impair Defenses
1Disable or Modify System Firewall
1Indicator Removal
2File Deletion
2Modify Registry
2Discovery
Network Share Discovery
1Peripheral Device Discovery
1Query Registry
2Remote System Discovery
1System Information Discovery
3System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1