--- title: "Meet Buran: The New Delphi Ransomware Delivered via RIG Exploit Kit" description: What’s interesting about Buran ransomware? This cryptolockers’ code was written in Object Pascal in Delphi IDE – a language popular two decades ago canonical_url: https://www.acronis.com/en/blog/posts/meet-buran-new-delphi-ransomware-delivered-rig-exploit-kit/ locale: en last_updated: 2026-10-27 --- [Acronis Blog](https://www.acronis.com/en/blog/) # Meet Buran: The New Delphi Ransomware Delivered via RIG Exploit Kit Buran is a new version of the Vega ransomware strain (a.k.a. Jamper, Ghost, Buhtrap) that attacked accountants from February through April 2019. The new Buran ransomware first was discovered in June 2019. What’s interesting is that this cryptolockers’ code was written in Object Pascal in Delphi IDE – a programming language that was popular in Latin American and former Soviet Union countries around two decades ago when it was being taught in colleges and technical universities. Let’s take a close look at this ransomware to find out the installation process, communication details, and encryption model. [Try Now](https://www.acronis.com/en/products/cloud/trial/) [![Image 2: MSP Threats Security Team](https://staticfiles.acronis.com/images/content/1578b8dff96325855c4525d865e7fc63.png)](https://www.acronis.com/en/blog/authors/acronis-security-team/ "MSP Threats Security Team") [MSP Threats Security Team](https://www.acronis.com/en/blog/authors/acronis-security-team/) 14 min read Last updated 26 December 2019 Buran is a new version of the Vega ransomware strain (a.k.a. Jamper, Ghost, Buhtrap) that attacked accountants from February through April 2019. The new Buran ransomware first was discovered by [nao_sec](https://twitter.com/nao_sec/status/1136426134436888576) in June 2019, delivered by the RIG Exploit Kit, as reported by BleepingComputer. A specific trait of this ransomware is that the cryptolockers’ code was written in Object Pascal in Delphi IDE. That’s a programming language that was popular – mostly in Latin American and former Soviet Union countries – around two decades ago when it was being taught in colleges and technical universities. The ransomware code contains a homemade RSA algorithm implementation that does not use Fermat primes (such as 65537, the largest Fermat prime) for public exponent _e_. Let’s take a close look at this ransomware to find out the installation process, communication details, and encryption model. ## Static Analysis The ransomware file is PE32 executable for MS Windows. It is 796160 bytes in size. The payload code is written and compiled in Borland Delphi, while the protector’s code is Microsoft Visual C++. According to the compilation timestamp, the binary was compiled on June 5, 2019. SHA256: 0bed6711e6db24563a66ee99928864e8cf3f8cff0636c1efca1b14ef15941603 ## Attack vector The ransomware is downloaded from an IP address (82.146.63.94) using the following obfuscated Windows shell script, executed by an SFW exploit from the web site http://makemoneyeasy.live/. The shell script saves JavaScript into ‘T.t’ file in the %Temp% folder and starts it with wscript. The obfuscated JS code connects to a remote server (IP address 82.146.63.94) and downloads the ransomware, saving it to the Temp folder. The downloaded ransomware file has the name “rad9683E.tmp.exe”. ![Image 3: Buran Shell Script](https://staticfiles.acronis.com/images/content/f9d9dc8bf707b0a18b3118da80fcb3de.png) Buran Shell Script You can find the infection process with details in app.any.run sandbox (https://app.any.run/tasks/4e32f20f-1228-4b2d-ae8d-4d472e586d87/). ## Installation Once executed, the ransomware checks its process command line arguments for the presence of “*”. ![Image 4: Buran Installation 1](https://staticfiles.acronis.com/images/content/87d8ce6d92d96e318f3e13f57f8bfaf2.png) Buran Installation 1 If there are no arguments, it executes the following batch script to copy the downloaded ransomware and register the reference to it in the autorun key. ![Image 5: Buran Installation 2](https://staticfiles.acronis.com/images/content/f8ddc245e1288f182f7cf6c706952c16.png) Buran Installation 2 The ransomware will then be started when Windows boots up. ![Image 6: Buran Installation 3](https://staticfiles.acronis.com/images/content/483ae75c16048af14e210a342bacfda5.png) Buran Installation 3 ![Image 7: Buran Installation 4](https://staticfiles.acronis.com/images/content/38c46c096e3b13af34e7c559de8ea256.png) Buran Installation 4 After that, the service key is created in the Windows Registry where it stores the flags and encrypted session keys. ![Image 8: Buran Installation 5](https://staticfiles.acronis.com/images/content/93158cc9f0e8393c25e0df8f2811d9ef.png) Buran Installation 5 ## Network communications On start, Buran sends a check-in request to the IPlogger service that is uses to track a victim’s IP address. ![Image 9: Network communications 1](https://staticfiles.acronis.com/images/content/2276e5d72ede60de703fd19dd43f7c6a.png) Network communications 1 ![Image 10: Network communications 2](https://staticfiles.acronis.com/images/content/04ea0263b04487c764afde6e4ebd95d8.png) Network communications 2 ![Image 11: Network communications 3](https://staticfiles.acronis.com/images/content/f6d89b31bec742a4c5351da32f867299.png) Network communications 3 It checks the ‘Knock’ parameter in the Windows registry and, if it is not found, the ransomware initiates the connection with the IPlogger service. After sending the request, Buran adds the ‘Knock’ parameter set to the ‘666’ string, which is supposed to be some hardcoded value that has no specific meaning. The same value is later inserted at the beginning of the file’s content for verification during encryption. ![Image 12: Network communications 4](https://staticfiles.acronis.com/images/content/0c81ded5d4275e77e15f5df2c84a916f.png) Network communications 4 ## Encryption The encryption model has three layers: 1. The ransomware generates a 256-bit key for every file and uses it to encrypt file data with AES-256-CBC. 2. The ransomware also generates the session key pair (RSA-512) to encrypt a file key and store it in the file’s footer. The session key pair is also stored in the Windows Registry. 3. The session private key is encrypted with the hardcoded master public RSA 2048-bit key and stored in the footer as well. It is not possible to decrypt the affected files without knowing the master private key. The decryption tool sold by an attacker is generated for each specific computer and includes only the decrypted session private key for this system. ### Key Generation **Session Keys** Once started, Buran generates the session RSA key pair. An example of a Session Public Key that contains modulus (N) and public exponent (E): ![Image 13: Buran encryption 1](https://staticfiles.acronis.com/images/content/54c4c5f6b74e4df54139833f5a4c0711.png) Buran encryption 1 An example of a session private key that contains modulus (N) and private exponent (D). ![Image 14: Buran encryption 2](https://staticfiles.acronis.com/images/content/e62e813d4df1590edc38b2e435373e22.png) Buran encryption 2 Then, the cryptolocker encrypts the session key pair with the master public RSA 2048-bit key hardcoded in the ransomware, and stores the encrypted session key pair Base64 encoded in the ‘[HKCU\Software\Buran\Service]’ Windows registry key. ![Image 15: Buran encryption 3](https://staticfiles.acronis.com/images/content/6c222f253c4fa0f7f233351ee6dc6801.png) Buran encryption 3 **File Key****s** A file key is generated using a variation of a linear congruential generator (LCG), with the time stamp counter value as a seed: ![Image 16: Buran encryption 4](https://staticfiles.acronis.com/images/content/05eb374adff1c24ce59234ba2c9c3b59.png) Buran encryption 4 ![Image 17: Meet Buran: The New Delphi Ransomware Delivered via RIG Exploit Kit](https://staticfiles.acronis.com/images/content/a0edf539904e8a47f62e25786a7adb4e.png) The key generation algorithm looks as follows: ![Image 18: Buran encryption 5](https://staticfiles.acronis.com/images/content/76851aebd31e7cb548fd3d20ed33419a.png) Buran encryption 5 The generated key has a length of 256 bits: ![Image 19: Buran encryption 6](https://staticfiles.acronis.com/images/content/4595db06dd7f7ea4a8d3e5aefab0576b.png) Buran encryption 6 ### Encryption scope Buran targets files with the following extensions, which may contain sensitive information for a user _:_ _html, html,htm, htm, xml, xml, doc, doc, xls, xls, ppt, ppt, rtf, rtf, dot, dot, xlw, xlw, pps, pps, xlt, xlt, hta, hta, pot, pot, pdf, pdf, xps, xps, xbap, xbap, xlsx, xlsx, pptx, pptx, docx, docx_ The system files are not encrypted which prevents Windows from crashing. Also the cryptolocker does not encrypt its unlocker’s file. _boot.ini, bootfont.bin, bootsect.bak, desktop.ini, defender.exe, iconcache.db, master.exe, master.dat, ntdetect.com, ntldr, ntuser.dat, ntuser.dat.log, ntuser.ini, temp.txt, thumbs.db, unlock.exe, unlocker.exe_ The file with the following extensions will be skipped as well: _bat, cmd, com, cpl, dll, msc, msp, pif, scr, sys, log, exe, buran_ ![Image 20: Buran encryption 7](https://staticfiles.acronis.com/images/content/43f597bce467b168441fc756b8496722.png) Buran encryption 7 Buran skips the files in the following folders as they do not contain a user’s sensitive data, or may cause the operation system to crash: _:\$RECYCLE.BIN\_ _:\$Windows.~bt\_ _:\RECYCLER_ _:\System Volume Information\_ _:\Windows.old\_ _:\Windows\_ _:\intel\_ _:\nvidia\_ _:\inetpub\logs\_ _\All Users\_ _\AppData\_ _\Apple Computer\Safari\_ _\Application Data\_ _\Boot\_ _\Google\_ _\Google\Chrome\_ _\Mozilla Firefox\_ _\Mozilla\_ _\Opera Software\_ _\Opera\_ _\Tor Browser\_ _\Common Files\_ _\Internet Explorer\_ _\Windows Defender\_ _\Windows Mail\_ _\Windows Media Player\_ _\Windows Multimedia Platform\_ _\Windows NT\_ _\Windows Photo Viewer\_ _\Windows Portable Devices\_ _\WindowsPowerShell\_ _\Windows Photo Viewer\_ _\Windows Security\_ _\Embedded Lockdown Manager\_ _\Windows Journal\_ _\MSBuild\_ _\Reference Assemblies\_ _\Windows Sidebar\_ _\Windows Defender Advanced Threat Protection\_ _\Microsoft\_ _\Package Cache\_ _\Microsoft Help\,_ ### File encryption If the file size is bigger than 66560 bytes, Buran splits the file into 65536-byte blocks. ![Image 21: Buran encryption 8](https://staticfiles.acronis.com/images/content/002792544db86c002349b79704205bf5.png) Buran encryption 8 In case of big files, it does not encrypt data in files after the 65572 (10024h) byte due to the performance and reliability considerations – one big file may delay encryption and could lead to a crash if the application hasn’t been thoroughly tested. ![Image 22: Buran encryption 9](https://staticfiles.acronis.com/images/content/ba86d6c40fa1cba51a833ae4d2a23dd9.png) Buran encryption 9 It also copies 1024 bytes of original data starting at 10000 and appends it, untouched after encrypted data block. This is done because the encrypted data contains 24 extra bytes added by Buran – namely the first 21 bytes of the header and 3 verification bytes that represent the string “666” that are added to the beginning of the data block to be encrypted. Buran uses AES-256-CBC to encrypt file’s data. ![Image 23: Buran encryption 10](https://staticfiles.acronis.com/images/content/60367e9a7e92a19d5d0ead389338a578.png) Buran encryption 10 ![Image 24: Buran encryption 11](https://staticfiles.acronis.com/images/content/a32a572ce1aeb8f63499c792e769130b.png) Buran encryption 11 Interestingly, Buran adds “666” to the file content before AES encryption. That is supposedly used to verify if the decryption has been successful. As mentioned before, the ‘Knock’ parameter in the Windows registry has the same value. ![Image 25: Buran encryption 13](https://staticfiles.acronis.com/images/content/4d65c3e596565d9ef694569853219ecc.png) Buran encryption 13 ![Image 26: Buran encryption 12](https://staticfiles.acronis.com/images/content/e4e0e40f46e2fb2b09b58de624908948.png) Buran encryption 12 The session private RSA key is in the memory before it is encrypted and stored in the footer. Also, the session RSA key pair is stored in the Windows registry. ![Image 27: Buran encryption 14](https://staticfiles.acronis.com/images/content/d780f7752b942d9e9056d61a58fd782c.png) Buran encryption 14 Once the file content has been encrypted, it is renamed by adding an additional extension that represents the victim’s computer Reference ID. ![Image 28: Buran encryption 15](https://staticfiles.acronis.com/images/content/77c6f572ac134a1ad4a72827fa54b509.png) Buran encryption 15 The overall file encryption process looks like the following in ProcessMonitor: ![Image 29: Buran encryption 16](https://staticfiles.acronis.com/images/content/a935f11a488aef8a8fb2564de6a48973.png) Buran encryption 16 ## Stop key Buran checks the value of “Stop” parameter in [HKCU\Software\Buran\Stop]. If it equals the personal Reference ID, it terminates the encryption. This parameter is used by the Buran unlocker to stop encryption in case it is in progress at the moment the unlocker is running. For example: _[HKCU\Software\Buran\Stop]_ _“320501A7-DEB4-A845-2530-CAFE445FE8AB”_ ![Image 30: Buran encryption 17](https://staticfiles.acronis.com/images/content/fa5057c02c11b1f2cdb163a58420b60f.png) Buran encryption 17 ## Ransom note In the folder with encrypted files, Buran leaves the file “!!! YOUR FILES ARE ENCRYPTED !!!.TXT” with the following ransom note. ![Image 31: Buran ransom 1](https://staticfiles.acronis.com/images/content/1ee0dee0695ed0e1a2941828ef2e1430.png) Buran ransom 1 ## Final clean up Once the mission is completed, the session RSA key pair is wiped from the Windows registry. ![Image 32: Buran ransom 2](https://staticfiles.acronis.com/images/content/b4f485c39bca849dde490e605f2e6d88.png) Buran ransom 2 Buran executes the following shell script to delete itself at the end: _"C:\Windows\system32\cmd.exe" /c for /l %x in (1,1,999) do ( ping -n 3 127.1 & del "c:\Users\IEUser\AppData\Roaming\Microsoft\Windows\ctfmon.exe" & if not exist "c:\Users\IEUser\AppData\Roaming\Microsoft\Windows\ctfmon.exe" exit )_ ![Image 33: Buran ransom 3](https://staticfiles.acronis.com/images/content/82d2818eb80baca6688afd3c490791eb.png) Buran ransom 3 ## Conclusion Buran/Vega ransomware has continually evolved since the beginning of 2019 and is now using the RIG Exploit Kit as protection against analysis. The ransomware is unusual from a programming perspective. The code is written in Object Pascal and compiled in Borland Delphi using the _fastcall/_register calling convention. The encryption code includes a “homemade” implementation of the RSA crypto algorithm without using the Fermat primes. The cryptographic functions are statically linked within the body. In the end, a PE protector is applied that complicates the malware analysis and makes it harder to find the encryption model. Even though the cryptography code is not conventional, a victim still has to pay a ransom to get back the encrypted files or pay a ransom. One victim reported at the forum that $3000 was paid to get the unlocker. ![Image 34: Buran conclusion](https://staticfiles.acronis.com/images/content/00e868bfe71fc56e92fd36e96245184c.png) Buran conclusion As usual, [Acronis Backup](https://www.acronis.com/en-us/business/backup/) and [Acronis True Image](https://www.acronis.com/en-us/personal/computer-backup/) can protect your computer against Buran ransomware -- and service providers can protect their customers with [Acronis Backup Cloud](https://www.acronis.com/en-us/cloud/service-provider/backup/). That’s because these [cyber protection](https://www.acronis.com/en-us/cyber-protection/) solutions not only offer backup, but they also include our integrated [Acronis Active Protection](https://www.acronis.com/en-us/active-protection/), our AI-enabled and behavior-based technology that is uniquely able to deal with zero-day ransomware threats. ![Image 35: Acronis detects and stops Buran ransomware](https://staticfiles.acronis.com/images/content/42a21cb0261574c5a3228fa17abd8236.png) Acronis detects and stops Buran ransomware ## IoCs ocsp.comodoca.com makemoneyeasy.live iplogger.ru 82.146.63.94 HKCU\Software\Buran\ SHA256: 0bed6711e6db24563a66ee99928864e8cf3f8cff0636c1efca1b14ef15941603 [Cybersecurity](https://www.acronis.com/en/blog/tags/cybersecurity/) [Cyber protection](https://www.acronis.com/en/blog/tags/cyber-protection/) ## Written by ![Image 36: MSP Threats Security Team](https://staticfiles.acronis.com/images/content/1578b8dff96325855c4525d865e7fc63.png) MSP Threats Security Team [Previous post](https://www.acronis.com/en/blog/posts/acronis-cyber-cloud-update-customers-gain-connectwise-control-integration-expanded-manage-and/) [Acronis Cyber Cloud Update: Customers Gain ConnectWise Control Integration, Expanded Manage and Automate Integrations](https://www.acronis.com/en/blog/posts/acronis-cyber-cloud-update-customers-gain-connectwise-control-integration-expanded-manage-and/) [Next post](https://www.acronis.com/en/blog/posts/forrester-examines-roi-enterprises-gain-acronis-cyber-protection/) [Forrester Examines the ROI Enterprises Gain From Acronis Cyber Protection](https://www.acronis.com/en/blog/posts/forrester-examines-roi-enterprises-gain-acronis-cyber-protection/) About Acronis Acronis is a leader in AI-native cyber protection, unifying data protection, cybersecurity, IT operations and hybrid infrastructure to deliver business continuity, security and compliance with less cost and complexity. More than 21,000 service providers trust Acronis to protect over 750,000 businesses in 150 countries. Acronis is headquartered in Schaffhausen, Switzerland. [Add as a preferred source on Google](https://google.com/preferences/source?q=acronis.com) ## Related stories Want to learn more? Read the latest stories featuring this solution on our blog. [Acronis Blog](https://www.acronis.com/en/blog/) ![Image 37: stc Bahrain and Acronis partner to bring advanced endpoint security to businesses in Bahrain](https://staticfiles.acronis.com/images/blog-card/9600f3eea83b8f4e168ea6c1409c8c26.png) [stc Bahrain and Acronis partner to bring advanced endpoint security to businesses in Bahrain](https://www.acronis.com/en/blog/posts/stc-bahrain-and-acronis-partner-to-bring-endpoint-security-to-businesses/) We are proud to announce a strategic partnership with stc Bahrain, expanding access to advanced cybersecurity services for businesses across Bahrain. **October 26, 2026**3 min read ![Image 38: Introducing New Acronis CEO: Prakash Panjwani](https://staticfiles.acronis.com/images/blog-card/30cb571f6f1aaa131733e5727a4a250c.png) [Introducing New Acronis CEO: Prakash Panjwani](https://www.acronis.com/en/blog/posts/introducing-new-acronis-ceo-prakash-panjwani/) We are pleased to announce the appointment of our new Chief Executive Officer, Prakash Panjwani. A veteran cybersecurity CEO, Panjwani previously served as CEO of WatchGuard Technologies and SafeNet. **October 15, 2026**2 min read ![Image 39: Acronis expands MDR toward broader workspace protection](https://staticfiles.acronis.com/images/blog-card/18e90e89f5ec4ef0901f19008d4ccbf2.png) [Acronis expands MDR toward broader workspace protection](https://www.acronis.com/en/blog/posts/acronis-expands-mdr-toward-broader-workspace-protection/) Acronis is expanding the MDR service with capabilities that make this expertise easier to deliver and help partners address more risks. The developments build on a broader commitment to managed security: helping service providers protect the connected workspace while giving customers access to the expertise needed to investigate threats, respond effectively and maintain business continuity. **October 13, 2026**6 min read