General

  • Target

    1c3d492498d019eabd539a0774adfc740ab62ef0e2f11d13be4c00635dccde33

  • Size

    90KB

  • Sample

    220128-1286ssehal

  • MD5

    43c1639156d450ee25958435121ee36e

  • SHA1

    ec018a996ffef52f31bd483e5bec74faba0d71cb

  • SHA256

    1c3d492498d019eabd539a0774adfc740ab62ef0e2f11d13be4c00635dccde33

  • SHA512

    e7eb4a41110860bac8e73873b41b4d92c7ec6662f2e4aab4b0420ab15e0a96651925fffd48e507cb397195d970b4dfeb85385f7602d73ab952d82a7dbac95045

Malware Config

Extracted

Path

C:\JXBQTA-MANUAL.txt

Family

gandcrab

Ransom Note
---= GANDCRAB V5.2 =--- ***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED*********************** *****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS***** Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .JXBQTA The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. The server with your key is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- | 0. Download Tor browser - https://www.torproject.org/ | 1. Install Tor browser | 2. Open Tor Browser | 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/55bc5667451eebd7 | 4. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. ATTENTION! IN ORDER TO PREVENT DATA DAMAGE: * DO NOT MODIFY ENCRYPTED FILES * DO NOT CHANGE DATA BELOW ---BEGIN GANDCRAB KEY--- lAQAAMeVRSCLe6ULB28nlNSMBwtVk+eBxBTYj3XVPf0qEXLK0IdrguZoJ2NukOVo0wd33Sq/JdrmR9KClAW6xReZ7TzsdOpXWnpCoZQBhMLhJ8ezQoZdwqnxtuK/S1/KRgjsC/6iG4Kf27pvRDAKiJQyqh+xj/moJ+i0LEojBDe3Qe9XYGkJiPUoo3ubAKyl9k6e1zeL2Wh8t7anF45hyPbuHserTo5JiO/vKO0RaTQzNx6TTUMgs0cijCX5nO0IfsSG1Hz0H1094CWJUwQ017YBBxh+iXMKlVvOp1Zvziwm4+r0bGlLAys2F7XI2PwJeGChzMK6LwKKL5KEGUQBJZX03mFc+VGZOMoE+HTiBCc/l2PR8tw5OxlNG4d0c1DtiE0jxQaTIVF7cy3e2wo7BNS2ofdZsVyqJeHcQ9whDbe25VGQgPVlShkPATgiHiu6l1pwxUCED7PyG8NMcscv72Lm30oC8lSjPDNZtUWU5vV6P+MjaLnXVupsAx9zOjgsqG3nJTbrfQ02TxWuWbVWASocbcgJobxO7KrVPGMv/MUAK0BMO4xSuFmKtDl0xI1hQk8kqDCuw2zWU+MQ+edxozfwXzx9n1lH5Y0Iw028tWVWP5N1bDsc128ZSEFMbb0FsIu7bmNd6JpCqI0KHFE8FbdWIoDcM1mINs3LDm62K8FTUMPOyyk/pxjtLAAIt47ddj2pJ1iU0VmHkle7Sfc5cd6a0wZIocUIwe788rV85e8jZC0DdqNptqMrhosUkE5+latTyJiN3JW/wFwGXb6mhFzrf0qYUIgHiT1GZJjrjE8HXWReTy6SeHMHeSew8RQRaxKVUQj+vWs7BB9fotqg0uA8csknp2g++6jH7zpRYY0s6nDbfNYsuewLowF3Bk1hRdVY8yX+d6ywgZdoQibEO/6sXzxgvc/D15WFzElaN3qpB/ET8eLqkxGOq7RnzjJZOS5OziQKEHxougtFVAHFca9Nu+q8W5gP30FGfBhMTVkSdntyFqrR4477otgRjAk/KlVYkAk5rYi3c/vR6OhC4VzeHWJUpdxFZR0wcKEjGrwBq0hNPAI3cn/8sb2QShwakMi/aRIbd8Q0iyxRzuVT1uXdEmoZDpwC7jumVmmrscCqvr6qhG79Pol0R74K5cGXxHJ9qthyV0ey8FOSdF+17OsfqR1kw3DyWinyFeSIuDx1uGKOsLEpv6lSygeeGXo9SJJsCJO+ttfrVA+CPZEaiWpGbP6FqY53iQATVdov5yrRUJYay+yyFWj/DNE+MEbQutxDVbkDGG5qU+rRt6P+3Wcu6RpBiPQNxq+QOSbT1gEPSsFhqBRvDpVpL+I4QmaMeCuU23F1BFNH63S/JAUov4zUNs/U+cbj1mGl1gFllDw8QiH02ukQ12Iw4me/qO87wW0/UVR+EeCWwafyG0sPea/Mj2Sgi8EoaUWPd7aisz7ggv98Rs7b7MOW/mOfYc8FriLIJlypppYEJGtca7Z7t7VnJ4bF59l+XZmiHQjbVV2uhFVHB7dYOWbQ1MuZZTsIu/LM3f5xymT2uEhQQS63l2kDiPh14bSicg39oNE6kxxXbIPZ3ezyNiQNE1e7ZYorlqtxFNgoUhGNCHOjgs9c22Pz+DAOHaAj+MvqEPE7+3hNaSmPP7ConCIdGmgE2dJ4c9OXj7QADtg0W8mFn+SxHyywbdmmyjzULsHS8jAWREiFh22mDIkQp2xfqz4SiKAuQNTrGoZ2tE+0cfPIKfAOg2EdSbhjpBAcszLhzOONINjciG1DN6HkBPWN4Bc7nmEDhE5vwZuHanF38NeUHEFTHeZA4mjLJy+lZAU8GJWhcDBLYMkvcADJG/RSvp0ZwiijF1SjdgEk2sJltDP+erxn7G7v0wmy0H7yQ3J3FaktY8tjmQWiY6UT98nwA/6UTCC1X6XxaRfJ+p1uuLXEB7KUEn8HB8bgZSDv3J82Oj8+mnv/6EJtdfZ6hczy/HpgNdvxzqN7M6wkm6/v4ejklgTR5+38Jtcuah6YxAE6rmHfpRC/8NmaISKFd59UmhHBLWTVJIHm0c2Q38mJsmeMaA5wGk+v2dr+8ak6zRrgJot+Z3CFH9IUjlmX/GuEceGQUc4FokHmn+Ift4I1EwyDQIMaDH4DRE+lPICAq0jGXUwXvhpDq9Miy/t8AAqVNlzPCr0gRPJs6lLnsjT3t1H58hGT4fYY9wORHm7sONCqaCDjiWdJX5r26TlX2FCvcsgd1eIk4l2lp8F7ROY= ---END GANDCRAB KEY--- ---BEGIN PC DATA--- 7ftDEgLb/ZS0lcmZbHM61KDJ6AOtD78KkA7absMgUXYxWLsC+5+UYF9xVmDz9NTJN5DRAuyVsODZRWLIKnQXQzua3LPyzokSUuglaqKXwabsGM4pXku5In6gtMQMqg7sgEh1XW1iPMFgiUj/s1LdWpJHdiPjMpn7rCZNO/A31mak0K8RefoREu3BxtlAsseHWfVIIKN0U4NnA3w0Ga7XDLlF3iOIB6ImYbF6Z/7MBN2mgBr2rZ2gU1R7jNxjWLwyoIX95yRHFXKdMI+BkVChenio/1q0nJSZoF9ASQvO7zBnmOH7+ICDGAMpA6ikRWYVJPfL0xpSAyDDtLyJetAJBiFqr8ZrR7W3Y7GYmdORmkfYP43yqPNoLMfjU6OUr3FW3eYJTzTJsPa3LzF0vPeKSzSzgqAooTDFrJ2MPDmx5ShdudroMVoJ6iKVwumsqBhvYbwGrtkypi8B1eylBjnF7qJ4B+w+gT6wIUybb9cf69w/LTGj/LjfwFni9TPfKOqgwY3KWOb+rQlNvHGi04FWEvxEqyM7AMzhlNRGIAr1CUHEybaMY51b1lo/pORPew== ---END PC DATA---
URLs

http://gandcrabmfe6mnef.onion/55bc5667451eebd7

Targets

    • Target

      1c3d492498d019eabd539a0774adfc740ab62ef0e2f11d13be4c00635dccde33

    • Size

      90KB

    • MD5

      43c1639156d450ee25958435121ee36e

    • SHA1

      ec018a996ffef52f31bd483e5bec74faba0d71cb

    • SHA256

      1c3d492498d019eabd539a0774adfc740ab62ef0e2f11d13be4c00635dccde33

    • SHA512

      e7eb4a41110860bac8e73873b41b4d92c7ec6662f2e4aab4b0420ab15e0a96651925fffd48e507cb397195d970b4dfeb85385f7602d73ab952d82a7dbac95045

    • Gandcrab

      Gandcrab is a Trojan horse that encrypts files on a computer.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Matrix ATT&CK v6

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Tasks