gandcrab

General

Target

45d7d7b1bcad2b5d70f67b8ef7e006df8d03eb0d5e8af12a7aed5a68f1c34a07
Size

179KB
Sample

220128-z58trsdggk
MD5

8ec87fd3ea777fa8d5160dc957e6683e
SHA1

32e0c587eebce8913fe0f73f6e760929b3093c21
SHA256

45d7d7b1bcad2b5d70f67b8ef7e006df8d03eb0d5e8af12a7aed5a68f1c34a07
SHA512

9de2566930c84a1f398b6e9d298ecaaa9dd3171768f6ff6e327f1d5c7acb31a8753e7f4512ce5d34de551521842a768011aad431f12b041283c52a1064b5a5d6

Score

10^/10

Malware Config

Extracted

Path

C:\BQVLW-DECRYPT.txt

Ransom Note

---= GANDCRAB V5.0.4 =--- ***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED*********************** *****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS***** Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .BQVLW The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. The server with your key is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- | 0. Download Tor browser - https://www.torproject.org/ | 1. Install Tor browser | 2. Open Tor Browser | 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/7678dd21808fc4f5 | 4. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. ATTENTION! IN ORDER TO PREVENT DATA DAMAGE: * DO NOT MODIFY ENCRYPTED FILES * DO NOT CHANGE DATA BELOW ---BEGIN GANDCRAB KEY--- lAQAABTwcFcNw4zV0uw7tlMBugyLdQDHHJ3RAql0Jt3xcneuJORuVZ+QC70SI1WTwQpBvNg91PKTpS/nB1tCCR00QN1vTxWEYHgh5gr4a4GwjBR+FNGE425TVdiiuQDDa2mKj3mQMiu+VCsSBeU9IIx+mtlznLtMNLggzxYg9eJLDvQzW0PHZEjA9BK86MtyF6imyXGZk6PMK3vODUd7Nz/JkU7popN4dU9mesDDp+M6DxagYKjBagnT8Umak8qX1g/BTi+IqwUwxZYRE0M2FfTCHqCMxQNWxURm2UaF6c6NmT2HmUKOYCl/G59dGm/8vPcTyF5T9xip5F5ra8mNgf7uFJUWi3RvXXjK1o8KvTMkTHKmQ/syxe8PA6HmgFcYb/HEapPLYy25Qp3L5o60+a6nAlG12pJx++ppFgPBZbN+9jHjLYKk4emwqI/q+c3FU2SMKD54mOifAd0aAYIah9H5c+UR5VIxm94m+b9HP1P2LmVqy3VKrBT9qcdZQuiBx/jCCMe5al0HiVkbLVMAbaMP+AX0lCl6wvgbC9qFzRdrO6lsFJ7tuEGEONTdOr5uDWWptEDKzc7xwtDAAxRtrs8AACxOcor9Fnw14bq/JjA0G+55TYuI4e3025NtQkFs3UAi8DVSttjQ18wOpBcfb0DVxsn5aikfOQCz2OEJ9AN/BryP9D/wMfOtjBZzL7EMi5y2mSQyQyygWfG0hT9MsiXfSk8/QacNTG3ZpnhohVhbatotqTWPuBJujvD4Yk5IMDDv75XitP3fjE5eA3ZW0l3o6pS7n27zSj8jxHucmzVVSurN0yLzh3OCG+KOKdZfuZpi2noQRab20XO3AESpiuEU5dgbzNQvQ5zsLTJ5KAxiVJQJUnussmNbZvSoU1MTTPD2kKBv9GVYzcAyertvph8G3wOATlnKGqqJ/fVxKHhclDn0M5YHATW21T0f9k3HxOFAd1DNtQUjiD0ceisdLcsyz6ZmtMH8RWLf71LtN9jVBKEyaZ4EVI36jgFJgq7lE5ZWQOK4ifmOsSPjJj2OtpHWJDJW+0elsMHepHB9sp37kWoBIHY0rQIry5VUORVQYmXYVH/HgEaLwJHem1iR50kNCp6OY41L/jo5yChDOZCd3Eb/v0bPUmvSNMopVehOj9gwbZaZfdEAgfHvTTdvlT6UpLR5FCxXmLxnB00th1mxE3PO6VAKXV//yKMZzuQS6j9ycmR0tIfKojNG3UHHKPfbDrmnXRrKDMbscripDAHe/enoatd1BL8Zusu/JHcW0zyEjZHjRtEVZj2SmLwd/R7hq6hujOoZ5hrjBgNQ/ZTAe46xBYNoYKh+NnR02cySFQZvAzms4P9+XU/AjSgKn1PrhIQVFubuUSkX986t1tMRBas0D1m/MJIT1xQ9sbXztRkyJP6W2AIACU8UnQknihEwllu+1FjyW0V3WTrzbVdU/zfh4Bt4lEb2djMUJIJ9E2tW+QQ1fdSNz7/1qopfkp5jILxAbDQ9T+cRS4pRKKYw8GoCVMOIBOKACBNY2E2EBlB5vlGqdraV0vz1M7XRVjLhZYMcemyWDnlQZDtmq71qNBN58GebV2XtFank1qvPiZRS29mPAqsJwlW4QdVcVCaFZfZ/etVE4jzpgb5uHAiCJsgjD88GaEMwN93jn4HXWe+185zgVlBPwMUvolUOi0jolB1/eNxrSS9fRHqKg+otep/6VZD1Ml2a8ueNqcixvYe4SPmRkYPTYptLOAFX6nbzd06RSuDXh7fL4+H77kTCPKeGXMXyB7tSJ09sx4EoDlsU+h0wKSU3F5ecEx/zKlnolhC3L81GIZdPCGZkgQCSY+O19rD9JLfJWI3Hg3f2tCPORN5JicVHwv5ZXwCqqwUP8iP/pLnirox35AG+pjWhk1ZrawZS5OvHnKT1Q55nbWvKLlZzr5W+XMdS9qYGfKeQ2PAjxAT4vXT5tum6ASd1BRPypa/dEFyp/ZE7RhFiDJyX7kxjr5lneyme9EkkqfDKz4Lsv61q1PprdXbRr3OOnAFVjgnC+Gf3Bk8/4DZKZGTFncoUYWga7Nz2kwsTSaXfDBg2iwMIiyAsC8q12ZOhFJ1DW8MC/gnm50Qdav5SVWjReDUlAoawEuJ1EKVw0vXqyRoom1mapJ9G3pd2Gl9Z6Y69x1veO3AuCr0vxYPDUDe0+q1ycJMpmz8aeq5MqFmFjD8fB3JUk64SObrDTzQf2dMaxfpQDEobwDq7eYI4B+R17pSG7B4= ---END GANDCRAB KEY--- ---BEGIN PC DATA--- wfKD6iudumBkmpL8IRr4U4exEVaoOXLtwDwmOrT1y1YWvOiWMx5GYaRdvZZGToRRtXYY7nBWqLfMTHCHhh5qBJzzs9MC7736UkGSDDniUJJG8/LFF//kmGmoAZAGLo2j5/wd2UrxMJK+iqKhTkS3ArgAxrZOOOiXrbnhbWMkLHQnbYuWlMClYZxYU6SDxpopRo5r292AV1KIZBZV4APBuUHcKSIr2MWMI0O1MKIP2IpKLE2TS5wLmpQodXZhP6M/UPrO1sZzkDbgjYlAG3g8l65nVd0/CBUxKQ7KDJYrtX0vSmnFXg/ykfgtJNiwqfCnqbr85+Bi5LF0kU/B6OLw/zI2E+snGtNYbFqLBnHt/hHSEY8bpCcE4oG4b6a1Y8ZyGoyp2Q2iuJRzTRoqGlPQJIAJpJFswNcoAhPJnK0+Ce5dALefhGEwg7NrKg3sxA1KwA7/ZinpDhFE3vLLOear1wIZJ3RPRgGKcTnQ1lXgdH8bmQvf3SygQSZnxLJ6lsKw7HIMVY7pajeyfEEcPsAgPy9N3X8IQ3zC3qZcEuPtMkisBZ9MPJGmHt4OJb+RRYcPqYktV/LuurOUzA== ---END PC DATA---

URLs

http://gandcrabmfe6mnef.onion/7678dd21808fc4f5

Extracted

Path

C:\EVEQTPJE-DECRYPT.txt

Ransom Note

---= GANDCRAB V5.0.4 =--- ***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED*********************** *****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS***** Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .EVEQTPJE The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. The server with your key is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- | 0. Download Tor browser - https://www.torproject.org/ | 1. Install Tor browser | 2. Open Tor Browser | 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/1eef4d64eb0767c7 | 4. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. ATTENTION! IN ORDER TO PREVENT DATA DAMAGE: * DO NOT MODIFY ENCRYPTED FILES * DO NOT CHANGE DATA BELOW ---BEGIN GANDCRAB KEY--- lAQAAONGt+jj+cVb6kuVxCbA5+Azr4/JLmYfZwXpisCRiDXnE4sVGh44dvEIhk0XduspqiekhvGwWtdLYpVkEmJI7VuxQBddKoyFzABQswvmaYAUlRaPGyeSheUJU2f32zVwCWTPeKNaZnm48F8vXFPNRAP+pGqmyWwvqwaiFiexSjag2Qup4RpJTzq6MgjSwL76kecksqmaINATgTC/JL2xihRnR/U7OSW153II08HnKoxrdsYYb1H1vk2H0e4rGS8BldCE0fW4/skdxrxUYBbfZyCcxazZP/JgRPKa4xZOQvgqhLpTcIYYzEMliZbXTd0x15k4oua12Q96s20UbHptDmV4tDcutT6yA7swrnIhVUSahRiAnXjrLLhxZQa9g/mmYoVsSbbide6CoNC33h2FOHV0YaRHQ7JTKdcsXaspoyQbkRlsUdH67/hwfIgF1eeA0nK1IrqLwZ9+H7Q0ujMb79GX1hx3IVbM/rxcw6rS8bcT1RMKW57+/x1w8u+y0GT0tLrUQjPo7BtBPM3M5Ozwfsb/wtzhIjRfdo7799mPw2Klt7phJSd0ONw4/GVErG5mobo3gnjVdPAhkmjRdTYZq2oVb3re/3tymKHweJGIUMQZCrRn4u3oZhfyh5fsN5SH3VuIuDxWQUszTHGyfGiTkPKT5aOSRr7XDh9t8qQukcVDCz7RfCtcfP0moNR/e0gB2eQtR8RkRoZ+XaiPADzMoi9w7pLolx5ns80ktTojgbXu4GVI9kte9zJZx+97VmbSTfOGchluQiKXnesby6VZRq/YDdnNtK41K4F7EK2VNyfCvK7hO0XbstFzfiU6AxecPenyF5+GL4AwupBrTxEMtVzeYGv88zm1t4RcO4QOq2UlqvZdoiRS2+BLX9WTX5jpP9j0kioO8+uD8/uOiKLvK2mrbR3YD5K1CiDxZ+0qP3qxq1ins1tfCgtZ3ONDhYQNhncnAtHLauWlT5xg29rjHtGEEIBJPiMeseRd7lBdk/htPRKHG5VWTmWboq0hF1RANm0gxZV6S3ENf3vYBH2zhM9i/24qJg9yW0eI4PftUvFMeaWF2CPa3siXSmZnlQzl54sEWgN08z7n02wxc94j3Hfr5uUZ0aq6e2Dq+29awEKNrxQB00yiHN9orD812XWBDYW+6DTKK4WrsvRBTzgLBgtrglo5aP7txG7M5D1W5ICVPkVli5rF+mbjiO2e0FZxkROYwowJI48L/XjN1owzQZWRtubQaESFnc8gzwy+RFAs8/zPyxVvbh0T8t5EcVn3XlC88UvKoFMqiu3V5XHoUpMrHP8xhawGURbbqHwuz8ciOUlaC7CS8azKW/jX75cBN+zXLR1PPTT3EsK8s6jYf4YNNhL/Ye+sGY7UOQ1i73bWTijajhBX0h9czbPknoyZQqzXOlAZ1edjg3aJFAaGitAMmdGgmOzeYyRquzRaXzyosMO2jCmALlJ6b10lMBValfQEhsz4oqiAP7xCcl9FzFmTRAalkaWGQkS+wBin1/TaIk+0MBgvMNzD2CK/wNPU/b1h4F8P6T16GmiY+MhULpAkqUGiKe8HifrIKFrB2Chn2CJO6wOrSqW468azWUJqxR0/3H0xOe/WQV4RNI2bovZXlIew/vpP2fOX3PDne5c/wkMrDXo+vJHOC4kdfEN/9uE6S/j88JrU+znIqJLiUCOj9DWFX9xd3GkkvAWmVP/begs/n08PG3aZrAr99MyGzv4JwYZq+c0NAz57Yf3Lbi+Lu2jB9Lc+w5EKcqx+tDm1fOBcH7Ej6dbN0a8C9R1i1cKeXLZ2oCxSmXbGpW1ax8/Vh8RebzhXSM1JRFbW1UR5E+gwC/UcRUd45F0A3pjlxboDfHx6bw9uH2KTrgBHOUC0v4NhAtp5Q65J9URTET9xVIvSOTDVIDvzWn/9QLC8TerFRrafPlU9hDgS1ixtejEj+2eHQgO53vJWOfU2dWcv3fB9d631p03vBBPWA9qZFNxy9S0K3zvy3PvgZtOAvQTYArlB+un4cYPC/xRq8i1iZF7zmVGeaK1y+m7IjaqzuDRBCkASeMOYuDfmm/+lYcQyZjxhmmSLCvB05+mooRfUfGGoa5SGxLtXnHP3c5XPeXIsHmTuuDDUlAuiKHQEC5WccaOMCeFFUwDVQtjuR5hN9xcvYjLPil6F/xSmq5b2UHCU3bpQimloIn/oxticme3MKH6hPWSedeV7d8scjcZWaKDPWntdiobbiKzQ1xHEn/b6Zso= ---END GANDCRAB KEY--- ---BEGIN PC DATA--- wfKD6iudumBkmpL8IRr4U4exEVaoOXLtwDwmOrT1y1YWvOiWMx5GYaRdvZZaTp9RtXYU7nBWsLfMTGiHhh5qBJzzs9MC7736UkGSDDniUJJG8/LFF//kmGmoAZAGLo2j5/wd2UrxMJK+iqKhTkS3ArgAxrZOOOiXrbnhbWMkLHQnbYuWlMClYZxYU6SDxpopRo5r292AV1KIZBZV4APBuUHcKSIr2MWMI0O1MKIP2IpKLE2TS5wNmoQoAHZdP6U/VvqF1shzlzbajc1AHXg7l8xnT91gCFUxMg7ADMEr7316SnTFUg/DkeItL9jgqZ6npbr957ti57EmkU7B5OLx/zQ2EeshGt1Ya1rQBiDtuxGOEY0b9Scf4qq4MaaXY7JyAYzW2Q+irpQZTWgqalO6JIQJopFqwNEoBhPAnKY+DO5AAL2fiGE1g6xrIA3sxA9KxQ7+ZivpCxFJ3uPLaOb91wsZMHQSRlWKajmS1hTgJn9imRHfzCz/QU5nn7IultmwrXJbVczpPzetfEscIsBuP3NNnH9WQ2/C36ZUErLtf0jsBdBMMpGrHpcOL7+fRYUP+Ik= ---END PC DATA---

URLs

http://gandcrabmfe6mnef.onion/1eef4d64eb0767c7

Targets

- Target
  
  45d7d7b1bcad2b5d70f67b8ef7e006df8d03eb0d5e8af12a7aed5a68f1c34a07
- Size
  
  179KB
- MD5
  
  8ec87fd3ea777fa8d5160dc957e6683e
- SHA1
  
  32e0c587eebce8913fe0f73f6e760929b3093c21
- SHA256
  
  45d7d7b1bcad2b5d70f67b8ef7e006df8d03eb0d5e8af12a7aed5a68f1c34a07
- SHA512
  
  9de2566930c84a1f398b6e9d298ecaaa9dd3171768f6ff6e327f1d5c7acb31a8753e7f4512ce5d34de551521842a768011aad431f12b041283c52a1064b5a5d6
Score

10^/10

gandcrab neshta backdoor persistence ransomware spyware stealer suricata
- Detect Neshta Payload
- GandCrab Payload
- Gandcrab
  Gandcrab is a Trojan horse that encrypts files on a computer.
  ransomware backdoor gandcrab
- Modifies system executable filetype association
  persistence
- Neshta
  Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
  persistence spyware neshta
- suricata: ET MALWARE [eSentire] Win32/GandCrab v4/5 Ransomware CnC Activity
  suricata: ET MALWARE [eSentire] Win32/GandCrab v4/5 Ransomware CnC Activity
  suricata
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Executes dropped EXE
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Drops startup file
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2