General

  • Target

    6c3d5ab1ecfc9aaedd1722893d88af445029a19d3a0c67050bbc89da9240c31f

  • Size

    179KB

  • Sample

    220128-y7lxcadbd2

  • MD5

    9916e107b3d501c60d4baaf1b8f8a77a

  • SHA1

    b3f408be830c8f85ae2180b384c9e353a3bf95e4

  • SHA256

    6c3d5ab1ecfc9aaedd1722893d88af445029a19d3a0c67050bbc89da9240c31f

  • SHA512

    4c6fb7325ee3b0ed81f9f9112aadea2e5a1c8bc30decee41baa8cb72e0b66057ee7e47a97aac73bded395ea63f7676d8e0a48b39764872c1dacea32dad1d23f3

Malware Config

Extracted

Path

C:\NCMRF-DECRYPT.txt

Ransom Note
---= GANDCRAB V5.0.4 =--- ***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED*********************** *****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS***** Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .NCMRF The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. The server with your key is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- | 0. Download Tor browser - https://www.torproject.org/ | 1. Install Tor browser | 2. Open Tor Browser | 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/2c8ff492ac514f32 | 4. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. ATTENTION! IN ORDER TO PREVENT DATA DAMAGE: * DO NOT MODIFY ENCRYPTED FILES * DO NOT CHANGE DATA BELOW ---BEGIN GANDCRAB KEY--- lAQAAN3nc1V/KrgsIu3cz8GIhoKztfTE85rvntZP03VzCJsue3ECOgebmF+nebII26iDRlUXDPRgLiHl7A5196y3W0EXPpgs/OjnicwJiD8fmkiOvU619UVa0EQFCSJTKMB7bwgguRXe0B5lJWvTqgRVrF9EkCG/0yz3iFDWFl+fd0QmPCD5XXmm5jkMDRPGqLL0rCIvg6ExynZn7rWoRQoCWuz7YhuimHNY4JmQIBs5h97GVLWeqrx0f68gcW9VMlhPB+sQqyzMxz2OKaHrwOg3VUu2SURtjEaOGdbu4/66q3m0jYIOomCdoj5q2OrpYvcE3UjSs2F9tcJOLOTewJjQWZXCf1JcKk35taDld9E+ezLck9+OPnn3fy9CCI6Hpu+lLG4WU14rpfM+Ih15yhjCTWzHI/ZY/SUfXo4knayhlApIqV0ZgJ6gYq7t3ug4wtuvneMIlXQMDioxBwMpMvP59PsBX2/BSZPcBMFy0N/SR8zCRolOU9KXfLvLX3RM3z2krav8fXZfBkhaEf7RK3BhO60sCKdX3VYODmMzkCi2RyHQ+SyiyJZVq/HLnIviQyZlaQs2j7q/hpQbIsBLJtwDCpvTYTA8HLdobSorlG5G3OFwqAjtpswAiFXjj5DnBu0kSh/gZ8/1GEZURmszNKqlu0Gji2S5nKRuyYMMl/SQYfiem0MYsFUx+gTCXwVqmSd95HkK6niPoCYTS4F2aFtZvkPf9s6cQEU61IVrpUK0lxP8gnc3XQbovkOQSDa88Z3B97186obB5sHojfKJ5JJtMsm0qnk7QDAmE2dTisLlCIEQt1Vni02lvPf6WdxaUuQcay2pMGXA0NGMkk886HpzfO2G31OV51wLX0k7c7Q7nZ5eaLY33oRJ8sfx9/szcBB+rsWfwjc5nINCjkrOaCSjkwcI4lu5t7tmKWY2flQVlHknJjpaxE5LaREeNXelL9lmgKUZPfZ6bas/EZB3ywufmwAwuYJmW+PpfKRV7bU1OLXPwaDCfFs46pAmPQWmzfm79VSke749gV1CWEeJUkcdPFPmW2cCN90Bzo3GU3nQthXpX28NTTh/F6iEKZ5AOmXE5S9i68tDXfzWFJlneo43qJGl308tFyWwhiOUIXdjhoV7H/h0D4fOBb99jPZWpfoATGst9DR1RSzHmvtTA7Idpeamqq/pgHrz0hycZh7UA3ZnRkfPyykMj3it75Zi4uhYRqrNrrxzsct25WCLCG/8nBNMnRpXwqUYcK9NOuJZ0SDQOdPiM/ua1UMP6Ei1P7MZmrjlqOro2YWHbDAzwcUV2g3wjLFMtnNqkaLLeSihQroQoBZ54qLqWQ233CsXBQgeGAs1MjjEnT0pY+Ol1pj/8H8EpohBH+JVilr+SX7a6u3JJ3hw69T5AGULi5CnPDvW9JQKrv2u93Y/dCUQlwkBzO8w/7qbPCe7fdgcPYgwnsDV8HxeseZkboKBuab5qCmKpdcApITHeRbMptqHb09D0691fnxtCfIDbGcz/nr1kAMiA+iMtdaI+P4xetmwAgstqIN7/scPmfNS+dwV0L+LV0G1ie/9elS0bT359emoTejGFghtjdTit/5OT349ZgCeXHv7YS5vUK/cceiHHtYc9O3+E+0sSRN+MWbaNejaEnKD718Vw5vl5EUcwHpjyYNLtpBZp7d2AoH5ZtzZ1sGrh/qTuLFfWXSA8ENy/BT2cPynZiy7k7qYY6cURLaisRmoC/4mfBe2RlQfLXtikXOC4QzBeYBcYmVJb2a0EO2Wt2/WGpMMIBXOzBDf59LpBHk9dd6KR6bcL1ZudV8g1iumAbP/IpFIfpGry9+BAh752y5/zSGykJVORBkvAsAj0wIw1kODpWjtkW2wAEx7ZytAoIdCuP2G7eLNLy+o3pb6lY95e1Evaz3nEKKXxO9VGLJh3jZ6LxnlBpM8fzfnLtXs2oNFjxUwGZrIa6wbiwtBJCu46w2zfhB7ZD8cjqLbkv5SJwx5K/LYkw5GsA1b9omH8TEdeMUpkvzYJwa399sA4tOF699kj2/cz32KjjmvJiaq8/HG3mZJkXza1DtPaASsi+m6G5grmeDFpepyadhKNlt+qp+5H7ZYtzVDF0YVrJ+IDNvqLecHCYbCVfd9oGYiGsQ1ydja9zwcbrpNgoCT4FtExW7OEW6T7puTxoycSVpu84kL2aKW9SShU2uKGt7lBZAyQYQYbO7Yd9qkqYksW2uNuuXvrSF4oB6wUh2O5fRLQtsWs5g= ---END GANDCRAB KEY--- ---BEGIN PC DATA--- wfKD6iudumBkmpL8IRr4U4exEVaoOXLtwDwmOrT1y1YWvOiWMx5GYaRdvZZBToZRqHYJ7ndWpLffTGqHhh5qBJzzs9MC7736UkGSDDniUJJG8/LFF//kmGmoAZAGLo2j5/wd2UrxMJK+iqKhTkS3ArgAxrZOOOiXrbnhbWMkLHQnbYuWlMClYZxYU6SDxpopRo5r292AV1KIZBZV4APBuUHcKSIr2MWMI0O1MKIP2IpKLE2TS5wLmpQodXZhP6M/UPrO1sZzkDbgjYlAG3g8l65nVd0/CBUxKQ7KDJYrtX0vSmnFXg/ykfgtJNiwqfCnqbr85+Bi4bEhkUDBtuLy/2I2GOskGopYP1qGBibtqRGAEdoboycE4oG4b6a1Y8ZyGoyp2Q2iuJRzTRoqGlPQJIAJpJFswNcoAhPJnK0+Ce5dALefhGEwg7NrKg3sxA1KwA7/ZinpARFK3vzLNuat1wIZJ3RPRgGKcTnQ1lXgdH8bmQvf3SygQSZnxLJ6lsKw7HIIVY3pajeyfEEcPsAgPy9N3X8IQ3zC3qZcEuPtMkisBZ9MPJGmHt4OJb+RRYcPqYktV/LuurOUzA== ---END PC DATA---
URLs

http://gandcrabmfe6mnef.onion/2c8ff492ac514f32

Extracted

Path

C:\GKWANRQE-DECRYPT.txt

Ransom Note
---= GANDCRAB V5.0.4 =--- ***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED*********************** *****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS***** Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .GKWANRQE The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. The server with your key is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- | 0. Download Tor browser - https://www.torproject.org/ | 1. Install Tor browser | 2. Open Tor Browser | 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/439d6cd7a315a338 | 4. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. ATTENTION! IN ORDER TO PREVENT DATA DAMAGE: * DO NOT MODIFY ENCRYPTED FILES * DO NOT CHANGE DATA BELOW ---BEGIN GANDCRAB KEY--- lAQAAC8co8uH6zxdbCjYmjQvEVHfWQPvS8shQhDlZr3QJUbMWFJSN5BpXV0uQKVQHABdOPiBUAiimo+AB2li5eu8UrpHN2Jelh+w+72R5faW8oFnLSP661IGUbxXI8WeR/o9j6FQx8Jr2j+3ou/ytmo+K2QS3QZBfGdxwx6++E+G924URlpvp/84M13Ed34nO3nF6CABSBh7HM1vvgNjj0o0gRCHtIpUndFeWermFVuasbXaA7+U25wFUsDMAnFp8sklKkdU+HVKHxanZsMZCJXIMahpCgg2CkTUdamq2aKsswnjU0HdiZYO4rm+XqkxJ0/pA08Pa/EOs/UPfNM1xSoKRiEb3lqNTCd5bRd+yfMbbVyUOMMD+kSOm3vcbuRMAVLVM3tkYO+G5H1RA1RpViy9Msnem6w90ktRpFz9P2LpV8Z0ahOYkE7Q0tKI7VLLFG4q7kCXsWZhJ3wuJp95cak7LtOLLS/9xHToJueWfieStf9UzUWJp8jjnFzwPiTmkDSv5U4gd28VxhoSmMcxJvGenk5JvNwHiWnXgMwDa9srGEFx5NhMdYBfhKnzHxil9pif3muwfDTt5ChpxLCZGxa5LVkamXph6GXtDJbPGh52VNILRlCe3i+ORaK5mi2QxvmTbRBcVlLzusT2t5SCbEJQD4z4h56Ffs7P/TnFW948TVZRnl7B6GOE9iin1tAXgrmOEE0hwQMLFhfpXLbJJmnTooDBZE7MbX9yNWJ21cKApnB0Jf4czgiBgQ0vsR+J/02SKjPdGt5kHe7GZ+4lPMuV6ZnqkVXETh9RD97d0wtElHcquhY5qiy7maRjM3Ya5OSpLHsrq6xc03zTV5wI3JxdNGwXBg0YP0vTld53BR3vN/RZMt/4Rs5yfvkhJkMkkzs8ApS+ZII5JlVAsGXrNX3OSW7xvPAuXpA5gWmqHwVw0h88R5Yd5fdX+AYQoJkKouQniVIr9qRf1oL4DrDwpvCDGaQAJAbQ8HzbBE9XGD5bqD611jbjvplmiHgkNTUjCiexIlxSn4bptLkiaXt0EJ9HVfgwEiTDn/cft9MJyMH/ej2HDzh/QYg4za5ZmkZf8xaLPKMMRNlkdfUAAD/pKZUx3kJ3V9VvvHuvn5QQN5Cp78rxSkAXyzRT+hUlsp7TD+b45n5Ota8VsB2Jrhcpeb8fVcTK2nT/RhxOg+eN0wUfEhibS6vPT/tJjZb13jaiQxNaQIlX9CTC9hDe+yrFl7jJ9RPWr6YYOi9ud2q91WCutJpDdvDZXspD/0oFlt3rqR4dSV1vazcgCM9WRhkAuUi3rtg4r/DiDpKQxaRqF5Pgwnh1pPIMEsaSG0ogw97tA7fpbaCeRro+Vw+vFK3ttuKlUA+KGrLc4tYs8/nqz+LF2ljdWKEMxPJ0IBDRucZnQRDMj2tooB9kZNVqVZGroDzjtB99s6MGNciaWZqSiDsWMj0U1Khwl2UdIBwKZm9WJR/i7YYtucHVJP6cjrk5EtplfLOMagl1wp1dn8aV2r9uEnOujCwnNPYcRU+plmFFSRNUxXP2LZ2yMVApZx5AsTU6oHp560nSHTdgstpuZpVsGQP1lTOZX96gEzbIyS0Uh2liX25Q2Ne/EBZTrEcYRylZfKBQrZp5yP8D6U0jiWFcPJC7ihGbReOJYG5y9NPWshRpEBsYX7x12Zx8/k0GFjyhPpCK62lUoq2uUwR5mGf0Tpx4AbP5IMd26BXTcOAGIYEVIcxXjzvof8ROWxD4iSF+vUioOMBmPp4+HLv2MuqoL1dZpcqia1hy/aMxAwVYUBhHyugntEehlbHRT/wtMVvxybQMiDyxWPDpg/5L8f7oYIfZLn6wE8M4GRRD+B2uFw3DBsBiwT5mZDmOGRPPBoBFttSJyAtdRsDFZyepII5VAWiETK30pacvWohvIruamBwzlrONgCkZ+u4I88wEMaiJsB0gr5Mz9rypEkyPD+ftQwCkPfxgLic2AjsF1LnKTtDdq2RoBwvkpYh9QGQOsG/QrQFOPFjWfeKYdTYtA5xwtrocodjYzvuUITzfqbEjWH1JsoqY2VSfP6DmLU9fJ4Vk159iB8bMxFmxspa1sI+BPsO52loL3l6IG2H5HRAANzZegxKhUXlUVvU0kN3POJ3rGcD7a67Yo/bCXVihrKaBTnlE/uBr/e2ZzXkRYMIs2RfkMOwDLu6EMqGp/5mYxqSbTzPuuNhBUiSislrlBbCEH8O+R9qX10/9rw26MxWp/gXdLYOxdB0= ---END GANDCRAB KEY--- ---BEGIN PC DATA--- wfKD6iudumBkmpL8IRr4U4exEVaoOXLtwDwmOrT1y1YWvOiWMx5GYaRdvZZaTp9RtXYU7nBWsLfMTGiHhh5qBJzzs9MC7736UkGSDDniUJJG8/LFF//kmGmoAZAGLo2j5/wd2UrxMJK+iqKhTkS3ArgAxrZOOOiXrbnhbWMkLHQnbYuWlMClYZxYU6SDxpopRo5r292AV1KIZBZV4APBuUHcKSIr2MWMI0O1MKIP2IpKLE2TS5wNmoQoAHZdP6U/VvqF1shzlzbajc1AHXg7l8xnT91gCFUxMg7ADMEr7316SnTFUg/DkeItL9jgqZun87qh57li5bEhkRzB5+L1/2U2EOsjGopYb1qABi/tuxGOEY0b9Scf4qq4MaaXY7JyAYzW2Q+irpQZTWgqalO6JIQJopFqwNEoBhPAnKY+DO5AAL2fiGE1g6xrIA3sxAxKxQ70ZinpChFP3uPLaOb91wsZMHQSRlWKajmS1hTgJn9imRHfzCz/QU5nm7ItltmwrXJbVczpPzetfEscIsBuP3NNnH9WQ2/C36ZUErLtf0jsBdBMMpGrHpcOL7+fRYUP+Ik= ---END PC DATA---
URLs

http://gandcrabmfe6mnef.onion/439d6cd7a315a338

Targets

    • Target

      6c3d5ab1ecfc9aaedd1722893d88af445029a19d3a0c67050bbc89da9240c31f

    • Size

      179KB

    • MD5

      9916e107b3d501c60d4baaf1b8f8a77a

    • SHA1

      b3f408be830c8f85ae2180b384c9e353a3bf95e4

    • SHA256

      6c3d5ab1ecfc9aaedd1722893d88af445029a19d3a0c67050bbc89da9240c31f

    • SHA512

      4c6fb7325ee3b0ed81f9f9112aadea2e5a1c8bc30decee41baa8cb72e0b66057ee7e47a97aac73bded395ea63f7676d8e0a48b39764872c1dacea32dad1d23f3

    • Detect Neshta Payload

    • GandCrab Payload

    • Gandcrab

      Gandcrab is a Trojan horse that encrypts files on a computer.

    • Modifies system executable filetype association

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Executes dropped EXE

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Change Default File Association

1
T1042

Defense Evasion

Modify Registry

3
T1112

File Deletion

1
T1107

Install Root Certificate

1
T1130

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

3
T1082

Collection

Data from Local System

1
T1005

Impact

Inhibit System Recovery

1
T1490

Defacement

1
T1491

Tasks