General

  • Target

    aca0b96126c813b0d29d6fbff9175f8ca62ff2ec6eed83bff76a73ae717cfcb8

  • Size

    131KB

  • Sample

    220128-xmsnqabda5

  • MD5

    1ef3f352d97ba827f446f6e8708aa054

  • SHA1

    eb910b00ff92247044ae7c3006c8946b912f798b

  • SHA256

    aca0b96126c813b0d29d6fbff9175f8ca62ff2ec6eed83bff76a73ae717cfcb8

  • SHA512

    cc58d395b38fe2908a5a6c58ef8a53eadf434ef27eafed19f6564d9cad04761575e0d8c0d1d68a5ee94edf066365d7fee2737c0e76ee4326c73dfee1c7f6b91d

Malware Config

Extracted

Path

C:\MWVYCU-DECRYPT.txt

Ransom Note
---= GANDCRAB V5.0.4 =--- ***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED*********************** *****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS***** Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .MWVYCU The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. The server with your key is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- | 0. Download Tor browser - https://www.torproject.org/ | 1. Install Tor browser | 2. Open Tor Browser | 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/7ef9cdc3f8338a58 | 4. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. ATTENTION! IN ORDER TO PREVENT DATA DAMAGE: * DO NOT MODIFY ENCRYPTED FILES * DO NOT CHANGE DATA BELOW ---BEGIN GANDCRAB KEY--- lAQAAGr6zOOlAAw1CEijbBzpurbIBSUXt3EP7be5E6u+4mi4bYmM00lHwMI+3+ZM4grqiogkLBBwwdlSk4aMl+DkxDXkAUOFX5nTbBcmkCsdmdujbIOQcP86xUS0yytqPlY593lqWdxkuYFPDF6braXhixf1QvlKDjQfCp/whGT6Y6W+qg4ihlv+UPoMniXz6RZipeVt/7FQuCdMmX5uPv/krOavkkrAmnMhQ7W4CSyQGJXtt0+sUazPC6SbERjJwxWTKDmopTJAJTql134PY58HZEORKGKDpdfD1V5GuhPuP47xVXb5VDmc0CPFJ7PEZxwXfxcKAy3I2ZkDfWRd2OlUgRqNLAu6jo1yh6YiBEWbNDbDIuSrpPghIAXylSavJi6i+Drgv3LHFRTObETDPVLInrK5e1X0ZbmL0wmex3QHssxtb3bzfoT1jy1EM1cmRPNO5ulINDQ0JXtqALJSBZ0gBUqcOylqZjCMxtOdZx/E41o10c4z5owOl3k7z7cUHVYwHLRns6c2a1caf9LpMNze2VZ+dXgKwmtIoRXVP53i6hhoxWI1GEE1fB/Kr8vZak3/wBborNbZIcini6xr8p3MA71dSViW1vKb0MKlI3JOxQBCBXgbQgxHn2rOV2Mw9Pv2CrNsUD+i5zdMTEfTOLNgD0Ft60PwkXL5IQimG6soScMDLjr1lUMGqVHpVSOWUs5dfRYC9kSBOVTYTPuypxprwK7a5ukZQWDWQhnldS/oePnYOwWWrZxYWS0yi7w2pIvlCj6CqsvYmm/0k3GgTD2oxBY+zXLTFGnTXZ5iMHG4wGv2HD2ixzj4917g1nQR5dyadqxkeSA5KCx47eqob/LvSy0nTIXL4fhEXBpqL290IoyU4Hd81ULFXJms+6xIVGwVfBJCRd+372MvIARheEXo9+htJ7JkDLmLtkKceRD678u3Hk1Gwv5xjZrsMCW6j0KIJLJC3LTh9M/y7AK5UVLJaXEzMD9inwTkc+xe+EX1GWC1QKJd+34kaZdAfSdu5Xd5iEfPs5+rLVMS2HyY8KNkdwXuEqw8zmx+jVeepxBVLG8y2swmcTuJ02aog9I6ioWDUVXhstIsJtZP7b25lLHyFTOkWQY8rOoiqv1ccldnOhPHY99dQ+FXNqVD+bBmIBWDfKHEuC4sXQ7/OC0TT+mkTuycIfRCePxAdFTGGVzp00cr2V0lJibLMOBlCHQ8wuCSBetO2Lp1nHl68bTHFFn0ugflkeubpn9kStcylC7Nd7NYAncs3XCY0jxZdYUFHKFd9gAxgZpnhkCRAmrbwkhge+5MbCY1akJYt3e/yJJ3EtXgDFt5jPsUpQxvDW1+tGOI5dm/Z//pR4xj7yPoXoSnzUoF5EWOg0vDEwg/ih50JPRtnQJy9FJOxvp9exTKvzvLz4DvCr0c5pQTFAJLS/dxjWb3L4Nr9v+eH2p4P29baRKxo9x1cfLAGJ729AkKIVY1wQwOcIDFGxhpBteJ0KY7bdE5Ma0//ltTbnlD/tMMMV7wpGOBCCSn+xYvsmfVWalFGT+Sk/bydAuArGFNXH9r/6Jv3DL4oUfNFqrueSykTWIpKjHiXgj0QPeOpgr2RtJiq8LgVYYMWMb+dDD+yGQLUxNcYvd6b6U6EHS9XjeLE84CX/QsMNPIFvhgmuIRpGzDLnT8YzsWHPKPP12ptcTaFbXgeecyu69tjBZIk5d0B6RhuBtC/RqQY3T73zQcKiwC7FHe2hUmN9UWgAI812Th5H+grhR+6ZYswleSkdaX4WuZ5dPpgwZwvU2qmB0pn32O8t7pQV0Jar0Irn4Yexkqlz5mgKkyBjGtJe2k2ZCfkeh+WFsQ5+x0WGS7JQD7n+SarI+iTqe5aFj9LN0pWeneJNpl3CdiGv3ZSksHFTXH4ob4hE24npl2D5PW8FrjBuFuy6DBQDVjr4rP9kzlDpSEfJr9HzJa7r5IyU/foCqeid77yyZEkHGY44GmQD382CM+YDVV2BIG5AEoHaqhQnOBl3RfJ7fwVS9q5nnyQhRYRAxkE2u69Xd72FKFdtVTBe1EdNkf8dOGyw8i4UjlTak/YVjEW2TUzec482eZ09lCjWl51SxG4oYCrgQxBiW9JKbu+EY1llcFWzNivLSUKCGnVMXD7PUewARdKVTunENlQWt5rw8xw50UIyDtd1JfckldE3spVN7ZA3CDDVJSbGDp1nO5Z2Zy0hv9lemXxoCj8HnMguslmADONwD4siw4lpscfTx76ro= ---END GANDCRAB KEY--- ---BEGIN PC DATA--- wfKD6iudumBkmpL8IRr4U4exEVaoOXLtwDwmOrT1y1YWvOiWMx5GYaRdvZZBToZRqHYJ7ndWpLffTGqHhh5qBJzzs9MC7736UkGSDDniUJJG8/LFF//kmGmoAZAGLo2j5/wd2UrxMJK+iqKhTkS3ArgAxrZOOOiXrbnhbWMkLHQnbYuWlMClYZxYU6SDxpopRo5r292AV1KIZBZV4APBuUHcKSIr2MWMI0O1MKIP2IpKLE2TS5wLmpQodXZhP6M/UPrO1sZzkDbgjYlAG3g8l65nVd0/CBUxKQ7KDJYrtX0vSmnFXg/ykfgtJNiwqfCnqbr85+Bi5LEnkR7B6eL3/zI2QuslGo1YZFqABiTtpRGHEdwbqScE4oG4b6a1Y8ZyGoyp2Q2iuJRzTRoqGlPQJIAJpJFswNcoAhPJnK0+Ce5dALefhGEwg7NrKg3sxA1KwA7/ZinpDxFN3vzLNeap1w4ZJ3RPRgGKcTnQ1lPgcn8bmQvf3SygQSZnxLJ6lsKw73IPVYbpajeyfEEcPsAgPy9N3X8IQ3zC3qZcEuPtMkisBZ9MPJGmHt4OJb+RRYcPqYktV/LuurOUzA== ---END PC DATA---
URLs

http://gandcrabmfe6mnef.onion/7ef9cdc3f8338a58

Targets

    • Target

      aca0b96126c813b0d29d6fbff9175f8ca62ff2ec6eed83bff76a73ae717cfcb8

    • Size

      131KB

    • MD5

      1ef3f352d97ba827f446f6e8708aa054

    • SHA1

      eb910b00ff92247044ae7c3006c8946b912f798b

    • SHA256

      aca0b96126c813b0d29d6fbff9175f8ca62ff2ec6eed83bff76a73ae717cfcb8

    • SHA512

      cc58d395b38fe2908a5a6c58ef8a53eadf434ef27eafed19f6564d9cad04761575e0d8c0d1d68a5ee94edf066365d7fee2737c0e76ee4326c73dfee1c7f6b91d

    • Gandcrab

      Gandcrab is a Trojan horse that encrypts files on a computer.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Matrix ATT&CK v6

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Tasks