General

  • Target

    a9254c4357e684756f5556ab0ba0182e5fb41401080f83af927abd432d8bccf1

  • Size

    179KB

  • Sample

    220128-xrf6gsbeb6

  • MD5

    c0a972bfbb576c4cd296bae03890b2a1

  • SHA1

    aba31c189fee54f510f8d39bed11f26a4eae6f37

  • SHA256

    a9254c4357e684756f5556ab0ba0182e5fb41401080f83af927abd432d8bccf1

  • SHA512

    dbab5e7c95fed285d85d63d0fa8e2c46f1a8c9df7825d8576b99a1906b54ebd07bf0256424e8f4b82edc8ac581db9a6285b121b77d9ea33d741229c60ed6e8d0

Malware Config

Extracted

Path

C:\CYYQHJGDE-DECRYPT.txt

Ransom Note
---= GANDCRAB V5.0.4 =--- ***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED*********************** *****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS***** Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .CYYQHJGDE The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. The server with your key is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- | 0. Download Tor browser - https://www.torproject.org/ | 1. Install Tor browser | 2. Open Tor Browser | 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/a902b13247230f4 | 4. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. ATTENTION! IN ORDER TO PREVENT DATA DAMAGE: * DO NOT MODIFY ENCRYPTED FILES * DO NOT CHANGE DATA BELOW ---BEGIN GANDCRAB KEY--- lAQAAG+R8Wa/h37Wen7gny8CZmWNM8EeBoCNEvO9bQpopHvuzgFsVpFSfaz6L+HQH8uyJGIqrifd+/IyRCwQQW491ztqVo9kGkHRJ5dx6PjG7cs4mkdjULBwpt1WyjWF4n0r8ft9nTb/KQYUyxefUrSU+jhiLt7AcKVq9djSfxGHWqjhYW7QP1gAgnDThmNLKUW/eKavATc1ngQpJAi/dRIEXtgwigHCAknf5FlZhOEYULF8oE/cq307mi7I7/26GbJ1bXmnZ+jo0Ba0rjjFt1UAz/g1rueAObrjgij+3K6Sv+GjtHQ/CZIxwR3T1R+Ml2wmvaaXn5OawOQz2hoJvXaAiixxYR5QpUvUcQGCPmT2nZuylmt0z5NPI7nZE6qsjpzhmARBHqX8eIJeUFgcHxmB34O26dbvxvCabMJjlaCKXXIAMxj3vOlJvNVOlmi7CB5vhxitA+t3DV/Wt3p2rwH4mXj1ZzKNRaBFRUGiOXSFYrXiZbnsMNHAUJat0YtOVOK7Vt8JIyQUrqE/2d5g5R73WxmZdZJz98o5l3cDNpZfVhXtL4cpdxdS3xo8YuOU7gbAR7GZnIKtssSXqZZVsbhcp9bCIiGzmNXWma4LKtqYxTYkh3i4q+jbfJBtSOXpOQyK0rNz7fm75ZaXaXiAZL8Gs8daEpi5+Shig4mBQ5ZpE+sKTISyMvW1yxNQDUHjQBYPKb5QPWfrxO6JNMs6YwmDrUwMRaEWIQJ9FVXHZGZVLrreIr4sdAEd5i6jNxYQkexQeyeQ6mEBK44zo2dS99jvTjwgVbZLV4XHUg017SYlSWhEPPX1mySbdk7yEh8ckga5KTL9X5syltAvn8bJQmoaigtXTIYY6lXaMjsT1QhDzd7kqEFcf8O2MhKRv/KHhcqlcJQBBg9d/24Fr8NSnFGxvTBXKj5CMbfnAXMSZlk5IB4ZtWLqGy0MPh/i7rDSzu0FGiL1kTlm8veXA/zxORzZAhvwGqpZUvtlstiHl2O3FB6XaLb0n4hoTp7dzd5wzeRI7iq2mAwTjfSZj3U3HmhToVfl9HfEkB9h4dYj/ryUmH9Mh9JgJlxPv93vuV9LRHjexzoqY9ysdtqMzdxT8NSzgTxsVIZTV5ecsxvUF0oRL1FvpOYo32/H8VBX9vPILsi4eIyXjK5O5SVEpPMjniVOyJvOpqx/sPVHYftPLEkX7Q5K3GrqmNjcircF25fsUQEH7ASpn9qwgVK52aJnhu6vwKi7LTc57v/W4Mw5RlQnV+B/ipBnwoDvgG34eS55oEfiuUk7P8Cf/FpTeFmJgUzamVwG0rsZJxEeYErOGe8pwunyqlEj2DJdO5ryefqHshiczWllpZd7pVDNmbhH5ngzIlmzIuTW8Hu8ywXSmOcsqMI1DAMLPiRdG/i1yfaRkHpbp3GSlQq7vnVOLoCcXjJoPFDj5ANodoMmeLIpZRW++RyNBkqDqvt3euvQq1wZfBaMU5Rr4UX/q52O6BXvWyek668TuKt8ssvCnTVJG2mJ3PaNw+b6Zk4aioYMTQhmeediS8QMjg5jyDg7rUbR+9eEv0l35GgoTdgq7D18U0Z+VvjKIRuhnyYfcxAwUDQa+kmqwfHjLu3/ZL1vuGXFq94HlOr1JcWALH9AtfqzI+7fOVFpSwZH36Pm3HJFPTQX3XK/fKeSbEsYlCx1ekNgFSkWR5lWNzFBZPNHCrKOLuZeFEE1e0fveq9Xl54Gp8ky+w6QYFKoj/3zE5BR19+ph233p+7nP9UOOHM49XtoC//7p9nBBQLurKgaJnSxqBLrvMUJuq+Z6pd1EtlKUGcaf0MvRQArdmDynM6P8XoT28X5F0P75bLO5NZ2fCURgOVhEeVQRcC7EZqz9TDZIyrhWk9Nv32OIE56HRf8gu3k9/qPNHWN7PkWMzRWdCuy12Li39RwszPQ3BAWsyAJIoTNHYJWPqwUx4/15I8XP/qeLbzdH7BKQ7lRm5OmFDLmTiqx0Z02kqmRWd3ki6NxXOOrFGyRItj1OL9B7k9/dtdn8qMx5UYWu1KbGCoBiFIrEgTvUo7SOfl3eG5jfwnUjbLVcP7Vg9iAqoamzIKc6zUrM5lNv6+2RoWIJ0uzkgZFhR31dE6ijMDlZ3ibd66xS5YQvntT3hl+VgqirJ7QcDV2256gyXrm3kz0h+1SqXCStDu0bDSQNU+E7XCjMfW+SukIKYG0CjogwfyUe6mq3Vt7jKmlNCNkde1YI1uU3vLPzivCEYd+oRuWxgA= ---END GANDCRAB KEY--- ---BEGIN PC DATA--- wfKD6iudumBkmpL8IRr4U4exEVaoOXLtwDwmOrT1y1YWvOiWMx5GYaRdvZZGToRRtXYY7nBWqLfMTHCHhh5qBJzzs9MC7736UkGSDDniUJJG8/LFF//kmGmoAZAGLo2j5/wd2UrxMJK+iqKhTkS3ArgAxrZOOOiXrbnhbWMkLHQnbYuWlMClYZxYU6SDxpopRo5r292AV1KIZBZV4APBuUHcKSIr2MWMI0O1MKIP2IpKLE2TS5wLmpQodXZhP6M/UPrO1sZzkDbgjYlAG3g8l65nVd0/CBUxKQ7KDJYrtX0vSmnFXg/ykfgtJNiwqfCnqbr85+BisrF7kUjB4uL2/2c2EuskGt9Ya1qBBiTtrRGAEd0btydK4o24b6bsY7hyY4zV2QKiqZRuTRsqAVO9JIUJp5FtwNQoBRPKnKw+CO5XALafi2Epg65rLQ3qxA5KyA70Zi3pDBFF3v3LOeap1xAZaHRCRliKfTnV1lHgYn9OmQ3fyiydQRBnybIjlsiw7nIIVZjpOjehfFYcP8A6PylN3H9bQ3TCxaZCEv3tKEi+BdhMPpGxHsMOI7+QRdQP94kvV//uurM= ---END PC DATA---
URLs

http://gandcrabmfe6mnef.onion/a902b13247230f4

Extracted

Path

C:\CKTASCW-DECRYPT.txt

Ransom Note
---= GANDCRAB V5.0.4 =--- ***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED*********************** *****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS***** Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .CKTASCW The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. The server with your key is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- | 0. Download Tor browser - https://www.torproject.org/ | 1. Install Tor browser | 2. Open Tor Browser | 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/7ecc09027ec95afb | 4. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. ATTENTION! IN ORDER TO PREVENT DATA DAMAGE: * DO NOT MODIFY ENCRYPTED FILES * DO NOT CHANGE DATA BELOW ---BEGIN GANDCRAB KEY--- lAQAAJtPtVqtsjqsZUJf4wSkaNuvAgTAP/OLghmCvyGErg2fHvf4ltq05jGpuXXY2odKUux/ar9+llXFxJ7UcOoP/06gXqStrGyL4AI5Pn7LJQb2WUbaH4TcAflwPsTEoPe2C6Bu5O6Hc/VZCWzNLqppgoelrSYYZwo7Ha4q+42bBlqVJk9Gm1XphXJttWQFB6uKtdDB8Ep+N0VwtbwMxQRZI0c+h+SYK0wh87WE3/37I3SLKQP+SquJr0MGz65Ts8sTILl52GHS4vZIqnsc8kFUeKPnIDqjYXYXk0HUNQ9hkeLF6edYVXrMZO++5Ib+8D7PeNuWpdvDWX3K2Vl6uxluPYm20NSRgOzHGq4NXxgEnihuvgwC7bve/OBKVMcLQdR8RMLUQNdUtAKIf1DRcDwRfsoCChEHB4/uPfiRyhfCKJE8kj6tujWogX/L0wQGOXjfNHqVsRI8Vl9A/ZdQj/JI1lS+l1SorUEGQ2NzvDuRcAgg5Fq4Wcyfm2TkkVkvHwfQGxS6fpUFW1sgWVoi0keZH7hEMJBWpAAs9tJeY7sjsS1iENRgYOal9ovYZamnaMDqKahTJc6vOJ/8Ef+85//RKtdI3ZyAjicvpYsW5eGqpUllsm9t/ugvwGKZB3y+2zmGaa1ZGViNLDXAdO6YVPUbQsx8uRITVo5C6QAgU+9v2aAwg/Xzbm1ZrDypXhR5bMtFBc7hs2tlgiU4OaIobdfVagfa1xEjo5IvryuW00iWhaMychpPLf98mfn4UAx89EjUNpu2maaoS6sjge398CNL0m331MWnD8qTDG4/jc/+0Q+mEJfeP6lp6kmkwcjbMRwqStZGMzImit1pCeNnuGN+TReDEx78atjooTedXhTp88RnQ8EKD5oJhPs500lEyrXy0jFe/5VJ1zRKRU8UDW7c4JTO12pyq5mcLcGl9d3Euf9fyFgqhXH3Zd0KbC3ZlrLa/kqG18El6T1GX4VROru/ZyrR7r0O0h9o1DTE3S88IhgXPaWOVp83+k/Aqysj/jJjNnRWCHFdnYMzlZjaO9Zlq4Pqy05A6Mf+3pzhoUk0ExsKQEIurcgBvii5vovxxtIRDn1j71blFdgXXfaxZaHcczjA24Wp/LzgHhnWoygaw+UnOKK+7gY0cgr21I7xmIPJgbv6jPvkf0ju7sZGbswKUK2gUzAWJDHfmKL58CDJMwzZ4VcEWYW0cZcxkPa+Jlt/ke2Bay3v3xwOBMd4CTRN8ttgNLj7e79VOa071JkuHSmxaHT+RP3gLE5cPdJ8nJNxez3q4+eLAcwbCyp9YF3MZ9OGB1KbzxO7gbjTw8kGiZuinYHIbM3iHoN1DUHl6LHNXoFEVcoGruglJzFZpsYlu9DVVRcTViiUimrbpN55WBtjVJblA40lRyfRu8S40j73abdUblPUvhEEKw7yaf3Jfgxw4x/96jyccbiE0FC+8Ph4i5pIr/4MZr5ZaL22qBLwArumNhnuW15Qun3D8NVoSURVCwIeLmjGMNELGxJcZhz1ET1ltoTnkGlmshGgYxVBuYAnVq4FwusvLVHcpFdKruQ+R9NSg3X9/uhCldzzhWzgCZEwSsNG6pregXJkZfUUoE8fNJOfr4s4qbip/T4lhILekxe0ugyrHkbHG1HFxebRw/BU4I4pURYQAljyZ2psplGpNJfW29sxUNSXGtq79nXXZ0/DtU2T+sXlqj8qgrhvoBbRez3phxKiurb7nWwxarXqPbJA6OI4Lekawq6kYWI21q2TdgGNjCIIVc6IXEGKlVZjOfMIvy0V2ezxgNx0tLbK44jN4yBdfcKnXXuo+5Q2BbGLEWdatCw+brdchdhF/pefz/aU2HTesMrSi0JQNeeg1qoejdNV0d6e4MSRta2MBE4r2aL6m7Lfg+zuUWX8Z1Wph/AMi9cijFZM6C1eLMeDXymTNZW8DgII4Z4wKg4Mu5cjeUDNse9HDJsJtv/KN7CAzYpS6I/e1bS8UOt74EXSbKRM8f6EWqfi1uwjSlKcve2RjZsf+VIDgB80+YPAqcGW/VJy8VcClrg+CQPweC8meiJ4ILczk0Nrxiz3u7/TlWbN9RJ1c8fErufSU8ROpAdN8/OPMgTQgyBOOEOpugCEye2JAkBefKFtoHhRDOtR+dpq3Q3DfgPnrVsf34LTZx7S/7Z/SgdJIHkxlDVtRQFidQWICMnEp6Tuln2wPm/LS0CEIaX9P73ajcGVzUFQdu1Ol9eCoGCrAMlbGydzdXe+VSU= ---END GANDCRAB KEY--- ---BEGIN PC DATA--- wfKD6iudumBkmpL8IRr4U4exEVaoOXLtwDwmOrT1y1YWvOiWMx5GYaRdvZZaTp9RtXYU7nBWsLfMTGiHhh5qBJzzs9MC7736UkGSDDniUJJG8/LFF//kmGmoAZAGLo2j5/wd2UrxMJK+iqKhTkS3ArgAxrZOOOiXrbnhbWMkLHQnbYuWlMClYZxYU6SDxpopRo5r292AV1KIZBZV4APBuUHcKSIr2MWMI0O1MKIP2IpKLE2TS5wNmoQoAHZdP6U/VvqF1shzlzbajc1AHXg7l8xnT91gCFUxMg7ADMEr7316SnTFUg/DkeItL9jgqZinpbr7575i47F7kUjB4uKj/zM2QusvGt5YPVrVBnXtuxGOEY0b9Scf4qq4MaaXY7JyAYzW2Q+irpQZTWgqalO6JIQJopFqwNEoBhPAnKY+DO5AAL2fiGE1g6xrIA3txAdKww7/Zi3pDRFN3uPLaOb91wsZMHQSRlWKajmS1hTgJn9imRHfzCz/QU5nmLIoltmwrXJbVczpPzetfEscIsBuP3NNnH9WQ2/C36ZUErLtf0jsBdBMMpGrHpcOL7+fRYUP+Ik= ---END PC DATA---
URLs

http://gandcrabmfe6mnef.onion/7ecc09027ec95afb

Targets

    • Target

      a9254c4357e684756f5556ab0ba0182e5fb41401080f83af927abd432d8bccf1

    • Size

      179KB

    • MD5

      c0a972bfbb576c4cd296bae03890b2a1

    • SHA1

      aba31c189fee54f510f8d39bed11f26a4eae6f37

    • SHA256

      a9254c4357e684756f5556ab0ba0182e5fb41401080f83af927abd432d8bccf1

    • SHA512

      dbab5e7c95fed285d85d63d0fa8e2c46f1a8c9df7825d8576b99a1906b54ebd07bf0256424e8f4b82edc8ac581db9a6285b121b77d9ea33d741229c60ed6e8d0

    • Detect Neshta Payload

    • GandCrab Payload

    • Gandcrab

      Gandcrab is a Trojan horse that encrypts files on a computer.

    • Modifies system executable filetype association

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Executes dropped EXE

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Change Default File Association

1
T1042

Defense Evasion

Modify Registry

3
T1112

File Deletion

1
T1107

Install Root Certificate

1
T1130

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

3
T1082

Collection

Data from Local System

1
T1005

Impact

Inhibit System Recovery

1
T1490

Defacement

1
T1491

Tasks