General

  • Target

    67db8a1398d4a54f1d1e4ee4e3f729e3f48b1d60380e478d61656fa2ad119df2

  • Size

    139KB

  • Sample

    220128-zahzvscggq

  • MD5

    f81080a77a7cedfb99c5bd3db78547c4

  • SHA1

    b50c76a23d21cb76bcaed830fef43b2702e8e18c

  • SHA256

    67db8a1398d4a54f1d1e4ee4e3f729e3f48b1d60380e478d61656fa2ad119df2

  • SHA512

    94e28b0f92ae6cefc83bf7d247ca6613d9f51290bd751b133cf14e841855019e0bf628c38f6c0d5b90d1a2b7aa06cd6bddbeb33f3dce195ec2cc6947e9dc8057

Malware Config

Extracted

Path

C:\GHHBKRD-DECRYPT.txt

Ransom Note
---= GANDCRAB V5.0.4 =--- ***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED*********************** *****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS***** Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .GHHBKRD The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. The server with your key is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- | 0. Download Tor browser - https://www.torproject.org/ | 1. Install Tor browser | 2. Open Tor Browser | 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/dc3360c3978910ba | 4. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. ATTENTION! IN ORDER TO PREVENT DATA DAMAGE: * DO NOT MODIFY ENCRYPTED FILES * DO NOT CHANGE DATA BELOW ---BEGIN GANDCRAB KEY--- lAQAAE3lARhe46P44qjB8VqQECrCl3Z3SVk4u3W5DKLdgKLNaIhfxoNqDIHkKk9hU81IjVun2JYZf2vCRIGuxeuhpQ0H3NZjx4pz9OdN+5liCq8dl877uyehTiC6L4m2w41vy22sCGCd6vQnHN8+r1h1W0DWIbEWV2xRM49LRu6Q+yItI8L61p+JYMBK2EyU9diKxBkaHm/oeAuDHQMpaa82wbFceaHef7bUwO7HAWLcoPctmmw4lY9tO3IlIC5BJKFJipKa51jTLaJkyl87uxkPxXI87RnhIwZNkIIyW1Y0spiws3+9dkLgVLm/Wq3en2PwFKHK5KJfBKz8WU1i0aQGjs+ChGBqDUGf/LRbN/rOCyZ2EPuKHMw/vx431Gm+CFa+8QH0K6jXd7kYUOS1ZCzEGEq58wGeLt/uL5lp74HKXsFTTZ2j67+tyS+OrPfrWSZe3V1RMwO3yndPz3f1Zpasqc2IbTWMNpm7FfsIoqIj3uPEvSO1TWB8l4DRWZQ4G+eWJsytbmMTE8WV1aSJhy/qSTo2EYjaUar5kWYOX36Hhp4wbobWDTw02cQ4OOFyrHAPpQXSk6ylud1UONi1kteRmyMyPMkIO4KlueJQ3V+1uiS/hLVnYYoJZ8xM1L7TNYTmrMKWGS9odDvwD74DHnn1oaXBYyI579WgvpGtneP04HS6dr+5FW9htWhXc09NSHKPKu0M/Gfk8k4JGS339fdBBad+KCU1NqtENsY8V9vScW8WgTUEm57Qdh4HzBtMzRDCgm+ZlYkajQdluVseyOFXXD68GS/8Hy+LN2iqf+ewvstXaz2/hhY9CQRWSrkisyKdaR23iGufySOVGuDgMU+aC+dCO71IdUl+g+YQgerBTDEaRizp7JEH9iH6eiKSstVKOLTvsiGd+MJeItmfhiazMJI3vZKpveP8FWUtczW3FmFc04HCHHUVDNffNIbNwtiOVffCmeF0Ely0XvMNL30gSlXmQ1Ynyqmr8gvxWB21sB75TbRKBb+v7NEYXJvnsubdyxSRRL82yAppPeOw64pIzyzZ2VRkQSIn4oxJD1c7VuMLKZx2RTBXfMxWpWas237KtTjf9Xy+EtahJUEFG2zS6cfjdH2jE9qkewqak0CfmmXRHz8ar4rOwoYQ72VboShWfPwqYsQW1MLLZALBm5yW86sCpg2icpe/mvmBvzanRM+4YqkD85prtiaeUFZcfRhE78UxJhx66Flm5DzGiNdh+mUd81uXeCmgV1MF2mNv/3ZSeJyFH05PSei5ZoSRBZcCnuRS5NKC8WYPM5s0vB4m7Zh5HGUImt2HmsGIpom2vAW98iAXAxCm3KFYAI9Yc6VD/p8K+vUzVjANQFnxNTbtv0U2sCdtMFdiS4oDtCEM/Pyoa3dPHAejsteWnNQGtWw1+0JohDIGA+HpJW2gLsJbwJVgScdwpZy2hXtVuvFqin2fBE8uORsfBsKnJu92I2fpo12c0pVxbfuDl88Oi7J4xp+QxGGWAN7lL9mggmrufHHMt+9IfAenshDuMgd7E1lrtJFw9HO3BBDwZrYFJ+hOsJ0JYCznpEJbDD3bnMHXGna7z5qzLtALYq+Px9rvQRzmCMqsih2+8KsMov+GQHkUZepQZxBxQ+kb8ln7nWZyQRBkgg331yRXiAqhhFZHt31xw8pnw9RMr6Hcm6wGbpdSavSbnT/hQ/qA6x/8wkbiR/3nMPUZGCbiW65fG3ki+MVaq8fhdgYW6hwIgNdANfg64rDS6wxp1xybgh9EO4a5h/1VTyYvSR0cJdU/mph+DlI4rO/frCSft97ESUhwkziHsGi0tSbyHL8umc7vi9UPshWqmx7Kg1LWsyoOxpEk0a9VpWlBlCz/PMY9kEx4m+acP8Vz1lgiALWPRKhXUJnk5JI0RodgrMbqCWbmel2iIXlr4J4JD4b9Tq4Vz44wVX1WntMVduLskFIIwPGVu8kak/o7UGnGt2+vruGd56NQkMBgOHjSWm65mPoQe7RoEC/7RvAmRYmMaai5O2IW+74u1bceDKwGp+jRy2VSRe/OxL07vxqGCEi/UniXS6VmAzOV4IlRgfq0qxkaKfdcBRvvbtT1stFP+3W6R0Nj9JAI5KfKwGJ0olR+NGDBKO9fsNqfMT0gxSzAcUlJVhJXqtbGA9de5IMP5PMkyAwxrvRMiV6TLbfwzQ4iHgqFubuzp0jGzwaPKofnOZ9/mIOu959bfUTCATwtz25aH9XoJBtu8/FQTOYwWBA= ---END GANDCRAB KEY--- ---BEGIN PC DATA--- wfKD6iudumBkmpL8IRr4U4exEVaoOXLtwDwmOrT1y1YWvOiWMx5GYaRdvZZGToRRtXYY7nBWqLfMTHCHhh5qBJzzs9MC7736UkGSDDniUJJG8/LFF//kmGmoAZAGLo2j5/wd2UrxMJK+iqKhTkS3ArgAxrZOOOiXrbnhbWMkLHQnbYuWlMClYZxYU6SDxpopRo5r292AV1KIZBZV4APBuUHcKSIr2MWMI0O1MKIP2IpKLE2TS5wLmpQodXZhP6M/UPrO1sZzkDbgjYlAG3g8l65nVd0/CBUxKQ7KDJYrtX0vSmnFXg/ykfgtJNiwqfCnqbr85+Bit7EhkUvB4+Ki/2Y2QuslGtJYa1qLBi7trBHWEYsb8CcE4oG4b6a1Y8ZyGoyp2Q2iuJRzTRoqGlPQJIAJpJFswNcoAhPJnK0+Ce5dALefhGEwg7NrKg3sxA1KwA7/ZinpDxFN3vzLNeap1w4ZJ3RPRgGKcTnW1lPgd38bmQvf3SygQSZnxLJ6lsKw4nIHVYvpajeyfEEcPsAgPy9N3X8IQ3zC3qZcEuPtMkisBZ9MPJGmHt4OJb+RRYcPqYktV/LuurOUzA== ---END PC DATA---
URLs

http://gandcrabmfe6mnef.onion/dc3360c3978910ba

Extracted

Path

C:\FMYHZHMTY-DECRYPT.txt

Ransom Note
---= GANDCRAB V5.0.4 =--- ***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED*********************** *****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS***** Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .FMYHZHMTY The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. The server with your key is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- | 0. Download Tor browser - https://www.torproject.org/ | 1. Install Tor browser | 2. Open Tor Browser | 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/829ea6f1e1cc6e80 | 4. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. ATTENTION! IN ORDER TO PREVENT DATA DAMAGE: * DO NOT MODIFY ENCRYPTED FILES * DO NOT CHANGE DATA BELOW ---BEGIN GANDCRAB KEY--- lAQAAFaMb9kyA55okFDhN1cwpM0NfDjWpfkNvuBV5oZt+21ioiv++17JobMCwG72tgfCL4h27LzshjdJYy1yZfefd6r3Y5R1cC1QQ0wBEXKin/Mf7VRuQcO7GTBINyTeVt5hGFuM9FPvY+ZE/nIvqe40fM24NrwBSKWvTDhv9eCD315aZLM6M1LndsNIIRNrZXzQbrRvMsZEAMKxf7lFXq+pEy1z1u990dhyLFgFRry/Wp3m6cxl+8JVl5sZ0RLHgFqioCkE8s6Qz/FV8sNDHVR71XZWwF15ezbJILCXq6uQ0v91lEB3GH8aY9ISQL/zQxeGLfJt0U/OTWWr9YUFv5JfhofrOxdPh4fzGXUMcNtAiIjVVUFyzPhgmXB4fOcxgrJhvGmcqkyexZwwaXWP1b5MCOpYurPjEzOl96Gc3J7dPnR4J3MM9rlzqC43RoV+iFNHXH1DHIaW1NzEFavlG4QwAQIvgnk2QC1/Cx17oIJOm7hC7qEJXQF1qfJZv0MH/MUIapf8P0hO3ux/abgZdOr59vFgyUJ4/Yit/WKX8ixDnTwUuUIvHcYwZYZAkpp5UciDgHgh+8y25c9NqySxfgamD2cfzTlyIsRaVbR8fJr3UnFnnYajuN8ZrnSfsmmORZOuIcoUmtEZark9NxEBfdE32Rf+zeYijsQLbfuN9pDGw9UT4bR9u+FsI78F70E0G6X+lVj1HYsYL+s5GT1UZ3nUwxQWfdLA6WXvt5mxMjJD9AHN+LFvsYdwvVU+jME+hcwbQqb2OdpF0ESoCWoFBJA6xReoiv3Scwnp14/7jT8/gVk9u4dfh7oJO7PRVbM7aEUSDUXM9fHtbU1J6qzvv4Txcl332REWZ98a7JJ4Mh9b71KKsHXY5/6xq0HWEz4EPFsQMoHoP6VdXR9jSvcEpVQo8FQkL+GRg0t72Qnaldcuy4yZYqYK7r92+OSbJZQ2hpw4wh7wVhW7UHFOSUtNb4VjDdZ0Xf9P0Ulj9PW5S7jLaS87ue8nm41y6nzcTfz4VTRvQFuPlkLxlDqoEgr7lyF4c0AS+NAPbhOADMn8MAdQlrIv4aumzU5ZvICNL/oUMjjIC6bqzBuS/VN/IIFCzN0/SJMwWItKO4NV+n+Jq+QaDDKFgh4kNsfcdEKKcZ7MxykwBg2c3DLctYta0Fdk1S5XCrrp8wDt0d0zhkhVRVvvnGqODRYVgt3t1lNJZV4ezsyeZZ5wPmXuZsnuUbZxiou5WWBFeamRnlQGWgWYg60nOHekzATSqqYCQp11f8WyOS1lZMxNBHzoKdq19Vc6gLx9LhnVfS/GlAv4Xtxj4u82LCA9saa8AaGOf5NFJm2MQnjOE/YU9tZFaTEEs35fMCjxfMApMYaX/yeJ4XQhiXZjUF1HBKaBXH3VAFY1y6Fa1sIh0KdthvFUXDiuYore3M73GChvfrW6Au5Vf2LeffgiruMzwicIdB94OI/nV7AReH9l3NvUFxwNvbT1BWXKgRm66BsBr9NFnK7waX/y2sHM3taldg78YyhNbsD75qyfqJxlCn6WYnEr5lf7zC6DYB9yhNZ+dfnPcQr+RQx5lwHYVhyCjMZYIvdL8LooMlJueR5XLOEPUoUHO2LZHZ9xmEbtEQma5yaavyRCeGJhzLwnbB+Ost2e0x35kRKf53LFqCNSUf+Vq43ldHmPqXonGdeE8NHrN3Zo2RMynu3PsT47g6EYzaj2qm1P9CEezOmQx9cO8C1jkE7Zw8GybeL4sI4gAan61iHy1KcmIo4guG6+WjEMuZeNGvM3dPgkF0aWEoEZKd8YZuSwyJxB1DJjTUcPcyF2kY5CU+6lmxxq5FcZ1CQAtldRYv/h5ydMX7vhw4obxxhct6Jik77O0Mep1ZcEhb/IQIyTwwndo5VHcTtK0TkyPOO5BZlLUro8HlnUBcpyJy1+abQaLoityNizrypkaGAxsDpuKoDIC6Vskf0F5w75vOYCgT9O1bDMhdWFpZnxVVS5N0LE3DXCwX5i5y4G9Usya1u3nHjwlFO4o4YbF6QvSQ1qaT2nlMxv7uJ7o1NFjII3dwX5h6hru0qhP+Uuhhj8yfQ0e0jxyOrgYey/KQyL6/0IeSTjAMDemBIQJrNKg8VppEnQaKcW7AZ3/pronuY925w/VvIWh8xpvVxtxLm36N/RmjTLwfouI5wr8pb98Bfo3vgRupcepoJ8Bub0CBxJgc2+Yaae7Uhww0rmugO7Mz1Zk3vz1bjnP6iMyfBcGJWOW1A= ---END GANDCRAB KEY--- ---BEGIN PC DATA--- wfKD6iudumBkmpL8IRr4U4exEVaoOXLtwDwmOrT1y1YWvOiWMx5GYaRdvZZSTo1RsHYd7nRWsrfZTHWHhh5qBJzzs9MC7736UkGSDDniUJJG8/LFF//kmGmoAZAGLo2j5/wd2UrxMJK+iqKhTkS3ArgAxrZOOOiXrbnhbWMkLHQnbYuWlMClYZxYU6SDxpopRo5r292AV1KIZBZV4APBuUHcKSIr2MWMI0O1MKIP2IpKLE2TS5wNmoQoAHZdP6U/VvqF1shzlzbajc1AHXg7l8xnT91gCFUxMg7ADMEr7316SnTFUg/DkeItL9jgqZen8rqh57hisrF0kR7B4eLx/2c2Qut1Gt1YOVqLBiftuxGOEY0b9Scf4qq4MaaXY7JyAYzW2Q+irpQZTWgqalO6JIQJopFqwNEoBhPAnKY+DO5AAL2fiGE1g6xrIA3txA9KyQ71ZijpDxFF3uPLaOb91wsZNnQURlaKajmS1hTgJn9imRHfzCz/QUBnlLIrltmwrXJbVczpPzetfEscIsBuP3NNnH9WQ2/C36ZUErLtf0jsBdBMMpGrHpcOL7+fRYUP+Ik= ---END PC DATA---
URLs

http://gandcrabmfe6mnef.onion/829ea6f1e1cc6e80

Targets

    • Target

      67db8a1398d4a54f1d1e4ee4e3f729e3f48b1d60380e478d61656fa2ad119df2

    • Size

      139KB

    • MD5

      f81080a77a7cedfb99c5bd3db78547c4

    • SHA1

      b50c76a23d21cb76bcaed830fef43b2702e8e18c

    • SHA256

      67db8a1398d4a54f1d1e4ee4e3f729e3f48b1d60380e478d61656fa2ad119df2

    • SHA512

      94e28b0f92ae6cefc83bf7d247ca6613d9f51290bd751b133cf14e841855019e0bf628c38f6c0d5b90d1a2b7aa06cd6bddbeb33f3dce195ec2cc6947e9dc8057

    • Gandcrab

      Gandcrab is a Trojan horse that encrypts files on a computer.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Collection

Data from Local System

1
T1005

Tasks