2019-07-14-buran-3-ransomware-notes.vk.txt

SHA256: c201b67cb570829122d710c2259d5342cb7c23a8e524290f0c371e68f410664b
h/t @pmelson & @James_inthe_box

QUICK <=> UNDECRYPTABLE <=> ENCRYPTING RANDOM FILEBLOCKS / => THIS IS BURAN / GENERATION-III / MADE IN USSR 

Whitelisted files:

boot.ini;bootfont.bin;bootsect.bak;desktop.ini;ctfmon.exe;iconcache.db;master.exe;master.dat;ntdetect.com;ntldr;ntuser.dat;ntuser.dat.log;ntuser.ini;thumbs.db;

Note:

!!! YOUR FILES ARE ENCRYPTED !!!.TXT;

Whitelisted Folders:

:\$RECYCLE.BIN\;:\$Windows.~bt\;:\RECYCLER;:\System Volume Information\;:\Windows.old\;:\Windows\;:\intel\;:\nvidia\;:\inetpub\logs\;\All Users\;\AppData\;\Apple Computer\Safari\;\Application Data\;\Boot\;\Google\;\Google\Chrome\;\Mozilla Firefox\;\Mozilla\;\Opera Software\;\Opera\;\Tor Browser\;\Common Files\;\Internet Explorer\;\Windows Defender\;\Windows Mail\;\Windows Media Player\;\Windows Multimedia Platform\;\Windows NT\;\Windows Photo Viewer\;\Windows Portable Devices\;\WindowsPowerShell\;\Windows Photo Viewer\;\Windows Security\;\Embedded Lockdown Manager\;\Windows Journal\;\MSBuild\;\Reference Assemblies\;\Windows Sidebar\;\Windows Defender Advanced Threat Protection\;\Microsoft\;\Package Cache\;\Microsoft Help\;\Desktop\;

Whitelisted extensios:

.bat
.cmd
.com
.cpl
.dll
.msc
.msp
.pif
.scr
.sys
.log
.exe
.lnk
.buran

Regisry Storage:

HKCU\Software\Buran III
                    -> Knock (iplogger)
              \Service
                    -> Public
                    -> Private