Buran ransomware (updated Nov 2019) - Bonus: Decryption Steps

What is Buran ransomware?

Buran cryptovirus is the ransomware-as-a-service developed by threat actors who offer discounts for criminal customers online

Buran ransomware is a file-locking threat which encrypts valuable data and urges users to contact the crooks for further (ransom-related) details. Buran ransomware is the version of a cryptovirus that now is marketed as a RaaS. Usually, such ransomware-as-a-service threat operators (GandCrab, REvil, Sodinokibi) take 30 or 40 percent from those ransom payments based on the affiliate marketing scheme, but the VegaLocker virus developers give a discount taking only 25% from the threat distributors using their ransom-demanding creation. In advertisements, this ransomware is described as a stable strain of malware that uses offline crypto locker functionality and offers global session keys, 24/7 support.^[1] The month of October 2019 was the big month for the threat because many reports came out, some samples got analyzed and revealed that the Rig Exploit kit is now used as a primary entry vector.^[2]

Unfortunately, this virus is evolving and has at least Buran and Buran 2 versions. Researchers cannot offer any decryption tool for the victims because the behavior indicates the continuity and possible improvements like new branding efforts in the future.

A file-encrypting malware form that appends an extension of numerous random letters and numbers can also encrypt data without marking them or changing the extension. Buran virus is capable of removing recovery points, clearing logs, and deleting backups. The first report about the threat reported that the added appendix looks like a GUID (Globally Unique Identifier),^[3] and is added to each encrypted document. Moreover, most of the files are marked with an identifier “BURAN” which signifies the dangerous infection.

After the data is blocked, a ransom message named !!! YOUR FILES ARE ENCRYPTED !!!.TXT^[4] is loaded onto the desktop in order to inform the victims about what just had happened. The criminals urge contact via recovery_server@protonmail.com and recovery1server@cock.li email addresses that can also differ from version to version since this is a product used by many different criminals. In order to discuss all conditions about data restoring, the crooks demand users send their ID's to both emails and also provide them with an offer of free decryption of from three to five data files that take up no more space than 10 MB.

Buran ransomware is a dangerous threat that no one wants to see on their machines. However, if the cyber threat has already occupied your system, you should be prepared for all possible consequences. Note that, the criminals are capable of modifying various registries entries and tasks by activating remote commands.

This might also allow Buran ransomware to inject other malware straight into the system and cause severe damage to it. If a Trojan horse^[5] ends up on your computer, you might find the entire system struggling to carry out even simple actions and launch programs. Moreover, trojans can relate to personal data and identity theft.

If you decide to contact the crooks, they will supposedly offer you a decryption tool for a particular price in order to bring back files that have been locked by Buran ransomware. Such people usually urge for Bitcoin^[6] or another type of cryptocurrency which allows the process to remain safe and untrackable by others.

Buran ransomware message placed in text file reads the following:

!!! YOUR FILES ARE ENCRYPTED !!!

All your files, documents, photos, databases and other important
files are encrypted.

You are not able to decrypt it by yourself! The only method
of recovering files is to purchase an unique private key.
Only we can give you this key and only we can recover your files.

To be sure we have the decryptor and it works you can send an
email polssh1@protonmail.com and decrypt one file for free. But this
file should be of not valuable!

Do you really want to restore your files?

Write to email polssh1@protonmail.com, polssh@protonmail.com

Attention!
* Do not rename encrypted files.
* Do not try to decrypt your data using third party software,
it may cause permanent data loss.
* Decryption of your files with the help of third parties may
cause increased price (they add their fee to our) or you can
become a victim of a scam.

We recommend denying any offers for ransom payments as this might be a scam. You risk losing money are being left by nothing. Rather than contacting these people and wasting your money and time, we recommend performing the Buran ransomware removal from the entire computer system and cleaning all infected directories. Buran virus - ransomware that can stealthily infiltrate the system and modify various registries after opening a dubious email attachment (mostly, executable). A program like FortectIntego might scan the entire system for potentially damaged or corrupted files and other hazardous content. This will allow you to remove Buran ransomware virus damage entirely. Note that it is very important to clean locations such as the Windows Task Manager and Registry as the malicious payload needs to be removed, or you will not be able to recover encrypted files. Doing that manually can lead to more serious issues with your device.

VegaLocker ransomware version Buran 2 advertised as a RaaS

In October 2019 ransomware campaigns got discovered that financially motivated threat actors delivered ransomware to organizations in Germany and other countries. These high volume attacks targeted companies via employees in the organization and relying on typical demanding messages attempt to make money from them. Improved and crafted malware designed to suit a wide range of environments and infection vectors, so the target was not a specific network.

It is believed that Buran ransomware tends to focus on victims in certain regions, hence the certain language in ransom messages and recent campaigns affecting German companies. Since it was discovered as a version of VegaLocker, Buran was noticed being sold on various Russian hacker underground forums. Using the affiliated scheme and offering criminals the discount for 25 instead of common 30 or 40 percent cut out of the ransom payments.

Buran creators focus on creating relationships with criminals and negotiate business schemes. The following message was discovered in Russian underground forums:

Buran is a stable offline cryptoclocker, with flexible functionality and support 24/7.

Functional:

Reliable cryptographic algorithm using global and session keys + random file keys;
Scan all local drives and all available network paths;
High speed: a separate stream works for each disk and network path;
Skipping Windows system directories and browser directories;
Decryptor generation based on an encrypted file;
Correct work on all OSs from Windows XP, Server 2003 to the latest;
The locker has no dependencies, does not use third-party libraries, only mathematics and vinapi;

The completion of some processes to free open files (optional, negotiated);
The ability to encrypt files without changing extensions (optional);
Removing recovery points + cleaning logs on a dedicated server (optional);
Standard options: tapping, startup, self-deletion (optional);
Installed protection against launch in the CIS segment.

Conditions:

They are negotiated individually for each advert depending on volumes and material.

Start earning with us!

The message created to promote Buran as a threat compatible with many versions of Windows OS and working for targets from various countries. However, former Soviet Republicks like Armenia, Belarus, Moldova, Russia, Ukraine, and other countries cannot get infected by the Buran 2 ransomware.

This is because of an additional location checking module, which ensures that data encryption in certain countries is not launched. Many facts about the threat remain the same as those characteristics reported back in May, so ransom note will be written to disk with the name “!!! YOUR FILES ARE ENCRYPTED !!!” and each file gets renamed with the new extensions with random values and victims' ID as an appendix.

As experts report, the Buran virus represents the evolution of the ransomware and the primary VegaLocker ransomware had a history of infections targeting companies. Developers are clearly working behind it and developing new features as branding tactics, so profits can generate from malicious actions. Interm of development, new versions with different features got discovered only months apart, so there is an expectation for more variants from these authors. Buran ransomware is the threat based on the RaaS scheme that delivers campaigns in Germany targeting companies.

Rig Exploit kit and system vulnerabilities used to spread malware

Recent investigations on newer samples revealed that this ransomware was delivered through the Rig Exploit Kit that is popular among other ransomware developers. This exploit kit also uses Microsoft Internet Explorer VBScript engine, arbitrary code execution vulnerability CVE-2018-8174, to exploit the client-side and deliver malware on the system directly.

According to cybersecurity researchers from LosVirus.es^[7] website, spam messages alongside pirated software packages are more often used for carrying a malicious payload. Ransomware-related infections are often spread via email spam and infiltrate users' computers by using stealth techniques. Usually, crooks pretend to be from reputable organizations and urge people to open the attached file for further important information regarding the received email letter.

We urge all users to be very careful while sorting out their email messages. If some letters have fallen straight to the spam section, better get rid of them without even opening as no reliable companies will waste your time by contacting like you in these types of ways. Furthermore, DO NOT open any attached files without scanning them with antimalware if you are not sure that they are safe to download.

Staying cautious on the Internet sphere and avoiding possible risks of malware infection is very important. The more serious you are with your online and computer safety, the better your chances will be for having a clean, optimized, and undamaged computer system. If you want to ensure that reputable protection does not fail you at any time of the day, you should get a strong and reliable antimalware program for this.

Automatical removal guidelines for Buran ransomware virus

First, we want to warn you that you should no try removing Buran ransomware virus on your own. By completing manual actions, you might bring more harm to your computer system, which can, later on, relate in severe machine and software damage. What you have do is reboot the PC with Safe Mode or System Restore to disable ongoing malicious activities.

Talking about the Buran ransomware removal process, we recommend performing it only with reputable antivirus or antimalware programs. However, you need to check the entire system for malicious executables and other content before getting rid of the cyber threat. You can complete such a goal with tools such as FortectIntego, SpyHunter 5Combo Cleaner, or Malwarebytes since these applications may indicate damaged data and fix the issue.

After you remove Buran ransomware, you can start thinking about file recovery. We have provided you with some techniques that are informatively described at the bottom of this article. Just note that the ransomware elimination comes first before data recovery as if the malicious payload is still active, files will be encrypted again.