General

  • Target

    53b58eebbfc0d6db0898132d72f191368a78a8e34140f0e74a2c179f3cd07664

  • Size

    208KB

  • Sample

    220128-zrct6sdgb8

  • MD5

    c7d5077960882259b85c01fd41c49ffd

  • SHA1

    6c8bc4d4d744c7157c43c937650919e44373d6cb

  • SHA256

    53b58eebbfc0d6db0898132d72f191368a78a8e34140f0e74a2c179f3cd07664

  • SHA512

    cd88b8239e51873f9aebd7bdb9e3ff61b7ce8ba4f8a136b7f692b9a3cda1cd2c05ad088498051321c6ae25d89594d8990f1939a98eb91bd217c8e1cfd492f91c

Malware Config

Extracted

Path

C:\MBFRSEOG-DECRYPT.txt

Ransom Note
---= GANDCRAB V5.0.2 =--- Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .MBFRSEOG The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. The server with your key is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- | 0. Download Tor browser - https://www.torproject.org/ | 1. Install Tor browser | 2. Open Tor Browser | 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/5b79ad21ae34671b | 4. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. ATTENTION! IN ORDER TO PREVENT DATA DAMAGE: * DO NOT MODIFY ENCRYPTED FILES * DO NOT CHANGE DATA BELOW ---BEGIN GANDCRAB KEY--- lAQAAOWsi3/8Prfx3M6cGqrBM7xd+CUompoSdidan/xylAS/hEczW9624GDaZPGJ9TqO3OQWNlhYHExkHgV5GvAaF7SpSn7Mq5DmMhUrmL4rl8OGK36az5HdM9b/LNsrVPw5YZFdHkwEFQwBgaa5jartIuv2zIetihbJpSYrWrLDlF9UoyB6KI8nGjsnrjD+FSfAjINYN8egqgf3K87gkODey3VIAqC03myRcz08T8wBmHXPQrJP5uUe+3t48MD46poUj5/8nNSkHUrcPoDYMm7m/VM6zCsqdBvNk9idTYDwck+XZdG7izh9Waa2pRlOJHE0OGvwcDKXuAmwp22BWU/OcALiHZJ9T9C04iVymNr0nX/l4efhc3aq3PsF1BPPzWzDt6mgYwbBAzs6T03R/tpbpMS5MR1oBCbxF+UtzwTkK87d2zq7xL8q6/TCjSvbiNnKh2a73K8hBkSpeQq5i+d6Dja3YrEMQe4xxJhQ8HzTzhT6ybf/prqEn1GOktohqcPbosBvDvQP6KPOu0rMdBPi7LQAk+N3P8463O4aS31EOzRFb2lrpapaIMBW+i1bNKSgYb5aDkQMruH7ARdvOITeL+J1lrW/WvzmaJSdpuW49lIofquFoTNadM6Qsz//jG4JzRY/6iYfPhAeb62DzEbW99S+HTCBQMRs9p6Q7REKlbw5YJmbLPyTcVvgfg1a0sH8StQqtJgaIUod4LB6HWwu9RqYedyFTaEyFLcfQ8YUVfTU50bewjh9BiDB6AmTOxlzHcBP/Ad/Sc7YeEC25rFP9nBFISyPDnFzLOgU+YiaqxsELrRqf1UZ59Ar1AAHzqujf6ldaFjpfwCiiu2Xm0rjFX/eU0Q3xvyGMEbP8B88gHHHIfzn6sfcGNh9F6WRGnIDqkHVsB705sEY2puEuRqorEJp40SEm78TlTlP5DyQVcYzOq0fzEdh9TCqzJhv4bTQqX3IEtMn1ERaJFJfoHIiSSx6cPwRvwXE28qHUOcEmFp87p13lvM6x7kAufaqIXMTMTq+ZvXm/Q/izO9h956IH9xAgTUYFco9DQLYpJPerEBu2fiFlF85ccUGndXUSta04cR6S5lCzGDfXYvwzJ06JfqktxgOCatoFec2FOB5gYESuHI46m6Guz0jMrjY675XBUAyNTCry6yiz926IG3g5Mvin4YEZh65NhNA05RnpX0zVj9iaFVgmw/SnIABQvwcFqyvYrIXFtvXYUVrlbzv+rrTep6mni+9t4kb/fX9PuZRG+L7f1PLTAe4pU3Z6R1PH0UlZZn6WO63MQNqT7ZwNsQpQkg/l9Jfmdq3xnR6jSpY+nzYq7COSNNeVNjlwu/osDGD5bmxmrLFE1Ofy9B4qwhHLsiF4YD3E7ItbxfdL2TfscJLrtIm7RwkzTlfWxXMVRoM9DLVkv9mzlgWSw1dPnxZ/3I126qxXz/25FfmfK4vIjYM3cRuf83tvE+vh+81EAyOVS0itZX7J93W+bBrWuwQNzYAvxurPZWKsUkLjgb+2LMnNPxt7XsdUgzZOA8cRSMEOFmZmGo8EMdj07EMCuJmE/9jcKVpNXNJeOphiYHrJv4bY1Ff2e7zIl44RSMIUEyjl9Q+YuoLHjRaw0DF0Jei0IYyDOK7OE2XDPIAlJ1sk0PZ0gq2beV2Qc/HLSuBT2W+JqgH9SVrY0+3nsa7ADHA+SM/KyN1LgoqoGvz7dV9cxBoBeMr4IupwaB9LnpzFX/u/N6fKERmOWQNurNw0WjJj8apbnCm49t80ByiZgMM4lzLX+6Jxh0fb/gZ5iwv5fOI6yNY3dKylgsEbKtDZAn7xOxCKTpD1ibQC0d2jjjnjpggj63wQV4suWfqClvBjpMdpqaIQ0eeLOyyJ7hjQY4nPMiDMX7unD0kxYcGuOLyHFKrk6XHg6aAbvdN7qN5LqC6ChK6Iw10fe0Utk85Cxvh7EhgSr0teGGxVcQOB6Li1AQf2zlgw3eiHBWyrhm9Y3yRq4Opr9hmHcoOAC8ulkcL0ULz+qk7onISDxJX+HBLQjNf74iW3EU8r86C7ZC/6OjCv5OrGygmEZOGZXbi6mWWba4/8GaBlKdC2H3HwpPgVoeQWT4V0i7z4oe6qYrcbGDUXUZ5x9/gaAU8mkz8IcI5vifVnLmbciMeTweNOFCGJMj+69wXFE8W3OrcD4Hw2nzdk/j1dzfFvHhxo7HKTIOHV/eGObS+6zEme8JgdvAWT5Cag6cZ0GhL7CaxE9OJ3o6fsHs= ---END GANDCRAB KEY--- ---BEGIN PC DATA--- wfKD6iudumBkmpL8IRr4U4exEVaoOXLtwDwmOrT1y1YWvOiWMx5GYaRdvZZBToZRqHYJ7ndWpLffTGqHhh5qBJzzs9MC7736UkGSDDniUJJG8/LFF//kmGmoAZAGLo2j5/wd2UrxMJK+iqKhTkS3ArgAxrZOOOiXrbnhbWMkLHQnbYuWlMClYZxYU6SDxpopRo5r292AV1KIZBZV4APBuUHcKSIr2MWMI0O1MKIP2IpKLE2TS5wLmpQodXZhP6M/UPrO1sZzkDbgjYlAG3g8l65nVd0/CBUxKQ7KDJYrtX0vSmnFXg/ykfgtJNiwqfCnqbr85+Bi5rEgkU/B6eL1/zI2E+snGopYOVqABiPtqxHREdgb8ycE4oG4b6a1Y8ZyGoyp2Q2iuJRzTRoqGlPQJIAJpJFswNcoAhPJnK0+Ce5dALefhGEwg7NrKg3sxA1KwA7/ZizpDRFN3vPLMuaq1wAZJ3RPRgGKcTnQ1lXgdH8bmQvf3SygQSZnxLJ6lsKw7XIKVYvpajeyfEEcPsAgPy9N3X8IQ3zC3qZcEuPtMkiqBZ9MPJGmHt4OJb+RRYcPqYktV/LuurOUzA== ---END PC DATA---
URLs

http://gandcrabmfe6mnef.onion/5b79ad21ae34671b

Extracted

Path

C:\WVZHIZC-DECRYPT.txt

Ransom Note
---= GANDCRAB V5.0.2 =--- Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .WVZHIZC The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. The server with your key is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- | 0. Download Tor browser - https://www.torproject.org/ | 1. Install Tor browser | 2. Open Tor Browser | 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/3bfab5107f75a1fd | 4. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. ATTENTION! IN ORDER TO PREVENT DATA DAMAGE: * DO NOT MODIFY ENCRYPTED FILES * DO NOT CHANGE DATA BELOW ---BEGIN GANDCRAB KEY--- lAQAAJgnsZucfznWOnLEham8MyBjo+DCcxIFpu1IZZotevqluh3AeU7Jcxvz9GsKMQcQqWtu4JOgXWgINBxWwxDbnj+1P0Th6bXrkReA0VNyC4BvFMjfaKg1/JwFEd7jKz8w13+WW3ucNaI00+O/YImLRcKoJEZpr9GsuavrT2el6BC+hwpB2EoWHCYwvdX+D4gwTsqAytnm0QIGYX1hGXKldkMysEDDKWLBQ9WKipdr1XHKP8lRDlDixuy6uH7XWgm62G7BzAsGddVFrCoNObymaV9Ttmd9msI+FuR4MuXYfv7wSJ2BUWSkNrMB5QcvOpRtJx6HPVJM2bbTnVo7JN5ViVBB3i146EsR6qau5YyHDxnB1urKJMk4EpBxWOUma14j/b8vJJ0WEuP13Qm69S+9ola5jOIedjIG7TDq+DI1NGuTjcJBVCxPZDSQKRtTuojmUD5gOE1RR5xCnoIGwjTE1L3U8jSTX+utCDtx4jOYQOW6xMp7uv6wjQ0SHkVyK6Vpo3vLSZhdsnLoQJjuvojzZ/fTGcWXHMCQFG0+rQMdu4Vdknmn+CGsqhNYdCoUmRauxV9g2qwCoP1CpUixO06uTtzP+UlrK/gRHTBcrKPhSU2W/h6LftZeDrreEvCsPYjX9KXP8sfJ0H1QQjiXsWwqV6de7SgJyoxvyHSSoqfHJFgrZHdlCD93s54IeOmTp4Uj14Ee6pnj1oqzty2QD42wHo2qQ1vFxi307F0phPGX73iQFAtHKb/zsyMQXgbEOYX5zGa3rEnBrtqU1NUpse8p4Cpup7DC2kFcezuy5Qx+WgHL8e5T8ZtQDDxXFJn9TQpJrHdlDz1bNANkTOBzgh28TtOuhTDf6hQvCMa9qfHpZPQ/4PlMTHU+dDhMm9KJBZ0pd7tCx7eMKll3AUF0YGf7+7m+ZtfKMP9SDo9Kr75oAHQ69i1hmr3I1IXw5mYLRvuZPROKshrRR5NJ5XumpA61B/sCDpS8eJS2+AoDtBRWjSByhOF5DPUWcngLep3+7btWEB3VcVcHvU19ALHNEbR5nwLemucHcfnsyPxSsu9nFTT5KupJxQRAN4g81cvDsiIIB5OmgGa7fgV3YUOpPCjHUu//n8KVg0GzCuormx7D1geZZyklO9hYFVi12Yko8TCL4GCvmf7fACg4qos/seU7b++f10Gz1RNjE2OYHiHNKF1oGL2f8cfVxYckqwxDzW1fxuMKyFBamisafY2GW4cqppi0vgH6qGL+BCMGP7PveQGKsQqPHBBq85J5t2FmqsZC3kfTBOHo3H7JMnxfP6GTITz9uzwa4mUGkhUBAy/5+4/CXP6yaPhTtT14cy89PsB5mityA6sROIk6EK+z5YELTuQMV+vzT5vwM0hG1dkroiEr7kERetxSHvFSAeY/IItUUxiY8ZRwax5ZHVqFcioEAmbLCq8fUBLoKjJcVKpVX7cI/21xYA+0nTywFOe5Vf0NMIW2npy1cBux5X+qaGQuP0kUfyn0/En/5jCPE3U0BCVXMerS9B8j8cubgRDz1tX46VWahfFF1z7Fnqqs4c0v2nR2lC+QLMxz8172/yCg0OBaNSNWXs7/gAGM73+791l/00/eSDoeWtDhdAsM3ocygc6/9zn8+ovnz5VGjzpfrxNuHMy3w5TAqzO4orNmIfu+g/6NKev2HrmDEVG9qfzLjrenxl7WoE3xT40ziNJlA7i55v+iuiZlZr32h34Z1LZdU/piOEESWoifVYMd7obR4LoE/XCNG56mif2PByHGSuNgWkopdObOhaxV94QYqf+eaQ9Y8rvsDhbLoX0m+Mxz+q48AbJK82Gj+PUgh2biE7AjnrcJvRwYfhXt0cMLQ2+zplR6QgWF0jse+cq9Ej45Qp85c01XKDSFNNp20ELY8HB+chyBrjm038Al9weGEgDJoR5+InUZnG9JvO2gL/ARZWAAjUpE1WYkLpKm+DobrPcnQ8CuCagh/rTWjTXELmqTPsWVqPFD5X44DKzLkU0BgN5dRM1CBV8lEE6z7AjuesT4uIIhiXYhS6FPAjIZ0++YGWa/n2gHDKGrjeLARLu3bCibvg6HyfbSmrcwf+F+qZrff2TjMU5Yb63+h5JP2HVA/m4iFrQGpJsNDpgCATU4u28AKxc84caijmEo2DsQgxlCqnSLZcL67bGsYEzWuzLi88u7tWrip2pd1uNT48bgb5ikPI1Vjonaz5DYfpFVaSINKtQszuIGydNNv8uTaCdWBHDYoEc= ---END GANDCRAB KEY--- ---BEGIN PC DATA--- wfKD6iudumBkmpL8IRr4U4exEVaoOXLtwDwmOrT1y1YWvOiWMx5GYaRdvZZaTp9RtXYU7nBWsLfMTGiHhh5qBJzzs9MC7736UkGSDDniUJJG8/LFF//kmGmoAZAGLo2j5/wd2UrxMJK+iqKhTkS3ArgAxrZOOOiXrbnhbWMkLHQnbYuWlMClYZxYU6SDxpopRo5r292AV1KIZBZV4APBuUHcKSIr2MWMI0O1MKIP2IpKLE2TS5wNmoQoAHZdP6U/VvqF1shzlzbajc1AHXg7l8xnT91gCFUxMg7ADMEr7316SnTFUg/DkeItL9jgqZynorr+57xisbF3kUnB4OKj/zA2FusjGopYbVrVBnPtuxGOEY0b9Scf4qq4MaaXY7JyAYzW2Q+irpQZTWgqalO6JIQJopFqwNEoBhPAnKY+DO5AAL2fiGE1g6xrIA3sxA5Kxw7wZirpCRFJ3uPLaOb91wsZMHQSRlWKajmS1hTgJn9imRHfzCz/QU9nmbIrltmwrXJbVczpPzetfEscIsBuP3NNnH9WQ2/C2aZUErLtf0jsBdBMMpGrHpcOL7+fRYUP+Ik= ---END PC DATA---
URLs

http://gandcrabmfe6mnef.onion/3bfab5107f75a1fd

Targets

    • Target

      53b58eebbfc0d6db0898132d72f191368a78a8e34140f0e74a2c179f3cd07664

    • Size

      208KB

    • MD5

      c7d5077960882259b85c01fd41c49ffd

    • SHA1

      6c8bc4d4d744c7157c43c937650919e44373d6cb

    • SHA256

      53b58eebbfc0d6db0898132d72f191368a78a8e34140f0e74a2c179f3cd07664

    • SHA512

      cd88b8239e51873f9aebd7bdb9e3ff61b7ce8ba4f8a136b7f692b9a3cda1cd2c05ad088498051321c6ae25d89594d8990f1939a98eb91bd217c8e1cfd492f91c

    • Detect Neshta Payload

    • GandCrab Payload

    • Gandcrab

      Gandcrab is a Trojan horse that encrypts files on a computer.

    • Modifies system executable filetype association

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Executes dropped EXE

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Change Default File Association

1
T1042

Defense Evasion

Modify Registry

3
T1112

File Deletion

1
T1107

Install Root Certificate

1
T1130

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

3
T1082

Collection

Data from Local System

1
T1005

Impact

Inhibit System Recovery

1
T1490

Defacement

1
T1491

Tasks