General

  • Target

    4be53abbc3663773fba73cc579d2320fd605fc5e9526004cb16ea6c0188193d2

  • Size

    168KB

  • Sample

    210616-ss9awamfae

  • MD5

    024e1a53342da10feb5355791b54fea1

  • SHA1

    166903446183914166529278790555b6a9f455b9

  • SHA256

    4be53abbc3663773fba73cc579d2320fd605fc5e9526004cb16ea6c0188193d2

  • SHA512

    5dacd247d46387f6b4ac47b28c14857b3f8b0a610460d9d75aa99b554285b8e601e6dda7eaee81c4b7fb826884d1781c2ed47c962db703e1423ad4845f6b3c87

Malware Config

Extracted

Path

C:\KRAB-DECRYPT.txt

Ransom Note
---= GANDCRAB V4 =--- Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .KRAB The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. The server with your key is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- | 0. Download Tor browser - https://www.torproject.org/ | 1. Install Tor browser | 2. Open Tor Browser | 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/c17ad45d64879341 | 4. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. ATTENTION! IN ORDER TO PREVENT DATA DAMAGE: * DO NOT MODIFY ENCRYPTED FILES * DO NOT CHANGE DATA BELOW ---BEGIN GANDCRAB KEY--- lAQAAE2hxf520hNPazRkXDh6cxNhii/7nibTb5LbbH69+EJPDi/oss5uVYpbzhU+dtQSvtLUFhWEBe2tGskMDyk/at8xKx8n0u2Pd4BzicmB6TF7OE7F20xCt2XWp3nsSOZXj1DZabgfvlctk5X127zd3ou5JsEk4KlFVJ6ofAlEbo5nL9+Xm0lx5sTchEaiX1CNL3c10Wux67GPNGXLE4WsIOZQ7055z68KFj3m52L26JKlYN3wetJw3s7yTfxvRdmrJ22Z/dnTQa3mvAgc1QjcYeeZ7zaqZSYVpe/8MJUUvC6aE7ltmJH+KtD2lV4OyzFeCJ/DwPo3faO1DW94lvAJcB4hJnlwB5osnfAhY/uxpqocxJT7ZtFQduV7zGSQ7DXpr5qNG+l8DueylXOHGTwVsrmedzRpPqyNUWETAdL2FOzetT6zaZ+jQivm6MK0WSW2q5DJrDarUpSqV25hSkQK0280ICYCORi9w7jyD7S48LfzhDb3uLFV+BhMzQ30W74h4ZKtx3eISIp7wzkLFWxBhwtGDSARty+4zkCees4oAg84Vx9fgTJjuOJ8wiwKzZ6D9FvZdrybuzsOGMTS1KwtJbOrp8FocUyw2XHBg7MxH9M+XB+lwyu/gTUfEDnuWpNn7pib35l+hIgitooeSpeOPhBlBuVzNx4PVu9sQtp6q+So4lIUwAokcM0RekqHfoltn88QqoonSYArj1j4RTVaW0HNuky/zAjPfIx1cMugwtShjMo7N9tKAxcr/U5NVmg+qUpEPOCx0n6iCof8Vg7yq5isSaNO7d9QNwZMeSmJg6YB98x3PUcUI3H9xw/2FXQWQAY3LeHAwZwRwrlXny4pZgNYHrnEDBGNEQvKduQSlo8y2BKKUkX4lL/3TNGHn3W9wx8/Jv8d+VANTpLdMtUDLlI94ur7IbHewjBskr14e4PAovZ6hT0qKiARVU1Z/GrSOd6X6O8zsmNz8db6YIG0rLxq5Za42OJGR8FbtN5JP/s61TbknwEzJ0XcuwoxqtE74dviZZuAWuBzbK12/IGWrrtjJ9pIKBjsoEM+sP9Fw0dxu8/cZJVs8qMVd6DX6rx7Xpbn1teLRbEeHPxAQctKCeQ4nE5yO3xEofjF36LhxWK5Y4K/Mk8tlYOta4CFkcorlP4jn437ROpu0GyvHxGXVrvcBxH7mjhCf5y1kyV7LB5tlNvbPRhJVnbQpkcowYWuHMPvL2wUbgeL2llmPiQz2c27RUjF923IQjj2O9T3/1kEDfxKtWXyoqO7B3ccSefNw5iu0XSXJKibVJyfmedp1r30VcRTDO7DpB28LxW0ZqxR1K3AGBYYEuAbE0JYiGeQTOM7yWvoHQkPDS5cSctuaDJVqSe0J9BKXFSXaj6Vtw3mRONeDUuUsI9wHdi9tG2QutXkOAnBe5rPHTvlAvtM1WIqfsNgQJxeCeCpm/Ew/j9GUPeyRLJSBKt619KWuSxUJIb/699Bjpt0YbyCUQNDFUyHpn/vrOgFbA9Xo63LEBubDgCJ82CXj0zncW7jZqJ7rcWPInr0YBDumfYEuTjoi3srcx1su3yG+Zits9kSWpf6uhCfr1bpfKW71vgSmdzYrjYZeOUIE2qBFZ9bzxt3DTWkdyPjG4aO8TrRhXkRt5f2HtnjDgqDlZN8vVfjESFzGjj46PaX247XNQRIvEE63mhrqPUOSZGCrCu320jc1xKxsK8ZmsKMuWC4APlsqCbq+LAbnYZtEUApJ1wFaZ1RRxwaLEM3/lvmCm0kaCRl64v4nI5JWsDspoexoqD/P0unKO5kHCYtNl0BQap+3noL9psGFWr2/0tfbVdFaLz3boSBKwBFRlBFuScLp5VynB0+xQabJ8xgVCRxjwXLMcqhzj1lHoubfTK+WlU0cAsJpy1IAKvBDfqKlER/kiTyOxeq5pmMx6u9jJz+rUmlxV7YZkqxQNj2odX1iDRFXQU0F9QC89YrYZUugkvqAjyL5KnIE/SOYkgagUYCmL+KA2nAuEMeZiwsvlnl/BNJCLYzohnUjqx2Y9PBURztNshjdBcEaR8FY+WiOnz3TBU9NCJafjv7zRhDOyp1KHPFVC63nR4ATrl+KIRZavwBfCnf8TofykZOdrQvSpuB0mqwfMFLi+n1/lEp+dDSATVFSSuK695BZKV+W0Jw6GTChsPWRL41778bRmS60mUC6SQmNnwjuH6aD3ePLUhwmlI15f40hqvF5IsHKaQLZX1ORsmM4PtA7dyvY1g= ---END GANDCRAB KEY--- ---BEGIN PC DATA--- wfKD6iudumBkmpL8IRr4U4exEVaoOXLtwDwmOrT1y1YWvOiWMx5GYaRdvZZGToBRsXYc7mxWsLfFTGyHhh5qBJzzs9MC7736UkGSDDniUJJG8/LFF//kmGmoAZAGLo2j5/wd2UrxMJK+iqKhTkS3ArgAxrZOOOiXrbnhbWMkLHQnbYuWlMClYZxYU6SDxpopRo5r292AV1KIZBZV4APBuUHcKSIr2MWMI0O1MKIP2IpKLE2TS5wLmpQocHZ/P7g/X/rG1tRzlzbsjcBAGngul51nEd05CBIxSw7QDMkr9X00SmPFCQ+oka0tOdi8qcGns7r357BijLErkRzB7eL3/2c2Fut3Go9YaFqGBnPtqxHSEdEbpicb4tq4P6bgY91yMYz32S+izJRoTWUqGFPGJOoJ1pEcwL0oBhPPnKs+D+5ZAL6fj2E1g65rIA3gxAhK3w72ZifpARFI3vzLMOau1wMZOHQVRlOKajmI1gXgeX8MmU3fjiyxQQxnz7JBlpawv3IDVY/peTfifFIcKcAhPzVN238JQy/C1qZGEv3tLUi2BYtMe5GkHskOOL+XRYYP+olzV/Dut7OUzJr9 ---END PC DATA---
URLs

http://gandcrabmfe6mnef.onion/c17ad45d64879341

Extracted

Path

C:\KRAB-DECRYPT.txt

Ransom Note
---= GANDCRAB V4 =--- Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .KRAB The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. The server with your key is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- | 0. Download Tor browser - https://www.torproject.org/ | 1. Install Tor browser | 2. Open Tor Browser | 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/d0978a417d8c7fd3 | 4. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. ATTENTION! IN ORDER TO PREVENT DATA DAMAGE: * DO NOT MODIFY ENCRYPTED FILES * DO NOT CHANGE DATA BELOW ---BEGIN GANDCRAB KEY--- lAQAAFw5ysw43txgcJFuAGOS/tG5kFGEypYLevSciv6bJI6c5WstFR2NsBCw829GkEeqjmbFsHQQ9qubTugVhR36K9fcBwFtw9IeAVeBaBtskHwZUF6f9ev74uX53a/Ht6E5AYtijcMzL5I0Ffe1MgmM7uQv42aGEglv5PvvDyLzJSyLLml8sm5FSyPSbKm46AFt8EeIbJF7MGEh6C/ziJ3M+wr2PAPUQnv5p3fHW61g6lWg/hZVCgIAXE3IWY/Uz1G1wMX/DHdqwrB59mLwg9oH5zA3fQrqw9fjUxohNrbcieYzXDrEbVz+719dj3SKaEHWAn+rJ01eoPX8tv8xocI/nVOZ8UQw3Gm1YSnbR1JAK6h2aQrIaAAx4hzBjUpTOTSdjgo6aRCkUSpDEMXCO9d9rPoDboBAd+FfFvYjnWocUKpbJwC8FLBBGlGfc9jfDRo9qzJFLP1UB8qVxY2V2mqZdXstgdRh73HJE+Z13Me81jFdCNYVaOTe52fGAyINbI6Ku4L3lgqm5BzqL/9mRkHarF3GLzDPylDqRZ5MJUc0xNSsYK5FRDOV4D/vJy30ttZswKQxyiqmQxPsCNAJBH9tGfwo/ep/UABoh//yhYlESXjnBDT5I/0np2e/AYdMwIk1BtPeE1Mznd89ghXCqJgZ4UZLqdiMtoj6K6mZsclooeYrjoAnwpYelp2iD5opGdf4tP0Fe1j7BRlCqDnbZsa/+hvreQb2B9jcWQVSHBKVxB8ADGB3rIwpTUuzx+pJyaFOIeXTr2cKSsSSnd1tamYn33YNVOTRadpowWPu1ncD6dFBVanLwxDCLGGx6NtedlUPADdvUQjCX2oAEswYZIQz5G11vLroPxWXcjULRiQ1sSVz8iIKBl4Sa0ZSoD041Fg3IquA9LWZEyn4wfCzJSOydOceFtpSDJNj7E1rDaT1Cttn4RScTYKQt+EUoZZs4sp72W+yJUJN3CfsisuIP6fjP5YCcBpDe43TxP7XnW+fsxGtkRfq+PE1dbhIRvEr2qB9dlDTSu8GAlEF/My3Zx2VE3b+Mthk6bCDtEiR3MsVVW0WYXMqZQ+zO/yEDJMguc7/b1FHn/ycWaQ+NDY9hPy736WYVBZ53bzpbyYWPxEul+D7d0wqhgY/36uqV9gSikFrIS9zSMYS1ZJw94I8zaHZjCKL4NGKokSJdYJv3psiZ3ZpJGgwejUg3/nF41FuGXf3+XPj+vJoig2cSRKMQtfcQHPos3wVIAjP4wHPv9H3LaoCcYzrfxOWuMUcJoBGfFsUcy7BJzvVAFWK/kqDKcVorluAxNXm+sg1phaYe1KUg+yzZrojgQZ1N6ayOrBGZFZQEMT3ML821BAhiFknc5fckVZ2la70DWdaf/Sbdx+s4mwLhgYNmhbu2MQqj7vi1ZFGbBZ+I+I0j60pu96PVFS14uDJTSE76wO+NAsMn1QeAqyv5T1DPSAYTBiacf8DcoxfLh2DAD+kk+z7LPCDKYW2RZJVbSQ1jl6Ue9mRVdB02YXva7k4Zi62idnDlHKYhpNYPZcaV+s81rKFYVgTJcuH29DFUu5Qd3zTlVVhRlkm31cf6G6Df3uMcUsRBsNRXCDEc20j/oR+rho+BpOY3/3MYwqI5lXnGgNlPioQhFFujA2LLqev41AhWDmIBpxc9R55TJTEZPBxrpjYNfkIKu650DyKGU1Bf0M7i6dxD4IwW+QKbrTPyjCYe5JFdYBwSD7qxyFAJMj89y3X0Ar1UxC5l/2vRPSj8p11QUB7UPUoaVXH5WD/3/2oKdtY872y36za73rj9rD/qIRMr+2UcyNAaQVXWP4ZsHne+FfB4V3p19lI6i43fVf567Eobtoafs74VBXYVskDeOvplBxJdfmQ+Ze5rDj9QFk2V/LI9wE1hVpwfXzmU8B80MWVYdVHWLPZDjXjL3f1GSnIHbwDaRhKuh94iSI0W+zhmd+O0+zE0vbzRhcqpPc1ylzbreoQWKwAdz7t5rUUsbgX9SIMxF8f1eK09BvALaitmAt6HwYqnrzJPj7Tqr++IzVZIQ+f0TVEH/tNjvoqcaSKevuwBDHyjQIp+aruxyDvHKMF/sIJW0+QmMBoUXc9MjqhImmSudcGN9+YfeRhtC/iFInPMsy5G1Vo77B+n2uyXNKpH3IW08a3QaA3P5pryVXeu+eyxZp6seJZX69hRCF2e23qUwq07FC/AriQea6iJFRRn+9cvfjjmpmr684mn9ut46bCRXWG8fU1UnA= ---END GANDCRAB KEY--- ---BEGIN PC DATA--- wfKD6iudumBkmpL8IRr4U4exEVaoOXLtwDwmOrT1y1YWvOiWMx5GYaRdvZZFTp1Rs3YO7npWs7fRTG+Hhh5qBJzzs9MC7736UkGSDDniUJJG8/LFF//kmGmoAZAGLo2j5/wd2UrxMJK+iqKhTkS3ArgAxrZOOOiXrbnhbWMkLHQnbYuWlMClYZxYU6SDxpopRo5r292AV1KIZBZV4APBuUHcKSIr2MWMI0O1MKIP2IpKLE2TS5wNmoQoAHZdP6U/VvqF1shzlzbajc1AHXg7l8xnT91gCFUxMg7ADMEr7316SnTFUg/DkeItL9jgqcun8Lqh5+pi67EjkUzB4eKj/zI2Get1GtxYOlrXBiTtuxGOEY0b9Scf4qq4MaaXY7JyAYzW2Q+irpQZTWgqalO4JIUJo5FhwNYoDBPInKY+DO5AAL6fhWEwg6xrLg3txA5Kww7yZifpDRFb3qzLZeak1wcZNHQARhaKOTmD1j7gLX9ZmUXfmSz3QV9n27J7lo2wqHJXVdHpIjf5fBAcYsBiP2hNgH9AQyDCiKYGErrtc0j2BYRMPpGkHsYOIL8= ---END PC DATA---
URLs

http://gandcrabmfe6mnef.onion/d0978a417d8c7fd3

Targets

    • Target

      4be53abbc3663773fba73cc579d2320fd605fc5e9526004cb16ea6c0188193d2

    • Size

      168KB

    • MD5

      024e1a53342da10feb5355791b54fea1

    • SHA1

      166903446183914166529278790555b6a9f455b9

    • SHA256

      4be53abbc3663773fba73cc579d2320fd605fc5e9526004cb16ea6c0188193d2

    • SHA512

      5dacd247d46387f6b4ac47b28c14857b3f8b0a610460d9d75aa99b554285b8e601e6dda7eaee81c4b7fb826884d1781c2ed47c962db703e1423ad4845f6b3c87

    • GandCrab Payload

    • Gandcrab

      Gandcrab is a Trojan horse that encrypts files on a computer.

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

File Deletion

1
T1107

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

3
T1012

Peripheral Device Discovery

2
T1120

System Information Discovery

4
T1082

Collection

Data from Local System

1
T1005

Impact

Inhibit System Recovery

1
T1490

Tasks