✕
Request a Demo
Rewterz
Rewterz threat Advisory – CVE-2019-1904 – Cisco IOS XE Cross-Site Request Forgery Vulnerability
June 13, 2019
Rewterz
Rewterz Threat Alert – Point-of-Sale Breach – Indicators of Compromise
June 13, 2019

Rewterz Threat Alert – Buran Ransomware

Severity

High

Analysis Summary

A new variant of the Vega ransomware which is named Buran. The ransomware is being delivered using the RIG exploit kit. Once installed on to the victim system, the ransomware is written to a file (ctfmon.exe), then executes and begins the encryption process. As is typical of ransomware, there is a list of certain directories, files and file extensions which are not to be encrypted. Files that are encrypted have the victim’s unique ID appended as the file extension and the word “Buran” prepended to the head of the file.

Impact

File encryption

Indicators of Compromise

Filename

ctfmon[.]exe

Email Address

  • polssh1@protonmail[.]com
  • polssh@protonmail[.]com

Malware Hash (MD5/SHA1/SH256)

0bed6711e6db24563a66ee99928864e8cf3f8cff0636c1efca1b14ef15941603

Remediation

Block all threat indicators at your respective controls.