buran

General

Target

2025-04-21_8981ec8170d7378709b0f9989b04a922_darkgate_elex_neshta_zeppelin
Size

251KB
Sample

250421-mw6ltsvkz7
MD5

8981ec8170d7378709b0f9989b04a922
SHA1

fe1923cef44847e0a128b66c445827e97c3ed7a5
SHA256

3be964c7bdd8349bed41823d242f36bc525df6323eedb9e6a7144118984020af
SHA512

22f05bc348e92e19f904e8d6d6cd1be768a20abf4b3a378425ba976dcfdb994fe8573dca526d7cb29604349977de0b62e2878b16cd972633a21f4df249dd7046
SSDEEP

6144:k9iaEaA+HPsISAzG44DQFu/U3buRKlemZ9DnGAeWBES+iia1vD:dtWvVSAx4DQFu/U3buRKlemZ9DnGAeWP

Score

10^/10

Malware Config

Extracted

Path

C:\Program Files\7-Zip\Lang\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT

Family

buran

Ransom Note

!!! ALL YOUR FILES ARE ENCRYPTED !!! All your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. To be sure we have the decryptor and it works you can send an email: [email protected] or [email protected] and decrypt one file for free. But this file should be of not valuable! Do you really want to restore your files? Write to email: [email protected] Reserved email: [email protected] Your personal ID: 23E-1A4-DC9 Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Emails

[email protected]

Extracted

Path

C:\Program Files\7-Zip\Lang\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT

Family

buran

Ransom Note

!!! ALL YOUR FILES ARE ENCRYPTED !!! All your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. To be sure we have the decryptor and it works you can send an email: [email protected] or [email protected] and decrypt one file for free. But this file should be of not valuable! Do you really want to restore your files? Write to email: [email protected] Reserved email: [email protected] Your personal ID: C07-C33-7BF Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Emails

[email protected]

Targets

- Target
  
  2025-04-21_8981ec8170d7378709b0f9989b04a922_darkgate_elex_neshta_zeppelin
- Size
  
  251KB
- MD5
  
  8981ec8170d7378709b0f9989b04a922
- SHA1
  
  fe1923cef44847e0a128b66c445827e97c3ed7a5
- SHA256
  
  3be964c7bdd8349bed41823d242f36bc525df6323eedb9e6a7144118984020af
- SHA512
  
  22f05bc348e92e19f904e8d6d6cd1be768a20abf4b3a378425ba976dcfdb994fe8573dca526d7cb29604349977de0b62e2878b16cd972633a21f4df249dd7046
- SSDEEP
  
  6144:k9iaEaA+HPsISAzG44DQFu/U3buRKlemZ9DnGAeWBES+iia1vD:dtWvVSAx4DQFu/U3buRKlemZ9DnGAeWP
Score

10^/10

buran neshta zeppelin defense_evasion discovery execution impact persistence ransomware spyware stealer
- Buran
  Ransomware-as-a-service based on the VegaLocker family first identified in 2019.
  ransomware buran
- Buran family
  buran
- Detect Neshta payload
- Detects Zeppelin payload
- Neshta
  Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
  persistence spyware neshta
- Neshta family
  neshta
- Zeppelin Ransomware
  Ransomware-as-a-service (RaaS) written in Delphi and first seen in 2019.
  ransomware zeppelin
- Zeppelin family
  zeppelin
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Renames multiple (6093) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Modifies system executable filetype association
  persistence
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2