General

  • Target

    50ab1dadecf027533a17ccd2f4c9fb571432285567c914fd81540b8fbd9203bc

  • Size

    139KB

  • Sample

    220128-zv6awsdhd8

  • MD5

    cb067aa3f71d1d59c9b91fe8b4632c4c

  • SHA1

    6a23e82b5da19caeea5b7b63cca00306325b013a

  • SHA256

    50ab1dadecf027533a17ccd2f4c9fb571432285567c914fd81540b8fbd9203bc

  • SHA512

    941aecd5c80c087767a69d7ddd589a69bdb424687d75fc406ae33e316b1543dd454bea833f0c302ec2227ff6986ed1ec9b1a12de64038371367a3dc8fe3ac0ec

Malware Config

Extracted

Path

C:\ORAAHGGRGC-DECRYPT.txt

Ransom Note
---= GANDCRAB V5.0.4 =--- ***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED*********************** *****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS***** Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .ORAAHGGRGC The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. The server with your key is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- | 0. Download Tor browser - https://www.torproject.org/ | 1. Install Tor browser | 2. Open Tor Browser | 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/d4f8919fa147539a | 4. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. ATTENTION! IN ORDER TO PREVENT DATA DAMAGE: * DO NOT MODIFY ENCRYPTED FILES * DO NOT CHANGE DATA BELOW ---BEGIN GANDCRAB KEY--- lAQAADVMaEeVK/0RA3xutKHv5BYh8X7R89EIb/+AcL3fyrPmTm0ILbXEBPiWh5e4dSlV+B5wbYhmtdkpjnc7Q8KZ3GeU9PC+N3tCdau8Cw+JIWObu3WEsjOziP9zw8H1VgV9yuUH0ga2giGTudhflymAtqJS9O4znOS1pDuB+0rvPyBYjlejH6qxRMUXYBshvWEdV5hrydOX2629BR8kkmr89U/NZ8Oe9wgza5ra5gn49pc0dErRv1LN96tLmTlP0QtCRN/Sr2pfdKevFwPaK/OAsxBfKwgOOplX6XPQBwBUrLfjaOxK9Y4vUssW7/3TQpQ/gqhsJw8JxRIjlaCecmhbdzVjA3WSW6Suhbi/6Dd4ilS2zn18he2TNsOXOfoOBIT1F5Ww/ngfprvnq8Tvjkevh0kr0JG67jphwVCQZ3iOxQvRCGJZtFEH29dD/Kgh0/HzlnoNRBUaQP2v/7cR+YoKKzjBWj/qoMAer1zyTiSId089m48FDktuldcllekhqCAle/gvj/4k7tgPJeFe7wC2zMHAtPsjB96rM3o+XF0jZF5FNzJk3Kd4LXiarmvkr5ejvpMj4ztKXI/XWSMekvc5sWP5/nWH+fnN2h9eH/et56vs+sK7cXc22aRUR5axTsDV0Mr85WHDvL0Zpmmno0rbtiDVzjcYY3VfDgaYPbMKURsk5GAAL2XTBzrMa6zFGjyokl+F0hUrYuv3uJMJBRIE6PH2fA6G08kIyTTLwGF3yE8mv+tnGtGYpYnBjmtuOiA4yP+sD/946BPeNwRTppHnYB0KzXM12Nh6G3GNViw5tM0/goVi41J7/lvyyG9GuZ3LemcyFCA4ak9KCrYiJhGSFcRACJXCGhShUvhGb4zAKn4iDoUmjqYe33pBAaYuARCN2WBAIfp/x5YxON9oLqqCkR9Suq0DXJY1Z/sAYhQiqclNGKnQQlW+KqsibxPIU78SwoLYFBu0I63ceJPYJ1PoXyKHccVGdHGBic98lXATRd0dTo3HwyLo53k8qRazLpyu4qFmFbs2yMFlm1hkG5AIYLWxUFU69jmQt1GQXmRAiegEj7sGD9Y9PGBZ5ODTRl1Og34E/o0rBtbhJJ3L3GYT6kVk8ajdZOhwIjLpcPOsGTXFsvdWiVHxgM5Q8Z48Ykc6zo2M3fmj6ORcAYz3qse5Zc8NEIXkXmjYw0FQljkdw6UPP2iUf8g57egl73G9YItq0yLzxcN8wq7lZlIIhKWWDhgfnZN2gwxjrNA3ce5ezo/1GuKdUcmTY2CUu8lZTLIAn7It4bNMV57riegUa9Ya8KvfQPk5/PrNdp4qVZN8GviA2iqVjnCiGQWcz7hSv5vcmebfKi/1X4Q4UxIoFYJbgF2MOTzSFoB3mnlN6h/cnNTmga8sPzK/yuHHjqcXwZeggapYoYFRKz3kZpPEjsN7NtYAM0QYiXiORsq+QNogtK0mLt8iVIg6OlRAF6EMyxD3VQYJduUD2yXK7R4nHM88sKXlTp1Wc7VALe8eSQteJ4S1OBTrOLYWSygEBr+WXCjqjT174BhnFPOW1MFji3tYZ0qSxucE/kpdp4QRFhQSxt/izTRIsGxms4gs6ILtJP5IvlHWGCUkztfzUyu8tAWTES7/gM8wCVgok3tqxmctx3zJklEvc7ErK9pWmIO9q7OzYloOJnZOsHyWAGdbYftDUXF8r7927z59O/Muh+H2J0cBG5DnrBfgt/RshPmO2qERgJieGYpGfiOHe115rE0Rt6UdcHV8btC0J7EvZvwb1IkqNhs5oHp7ze2XMZdXgVO1qH9914sH6SZV8ClPGS5JkrLbxQVGC4VoOmbzoVE7rwTbpfdQY+9MvxqkkY58lr0M8riR3X5nEpyyRyQA/obr6SZ6/W1x4ebh0VJmKVVfbioYgM9sX3gwGKlhZiChuhxOwLl2ceG+aPXFOZ+YBpbXRyj8LgTvA9e60dF3H+rciAFLofXg1cj2ozHoe1+lzjGtbgfb1FcaVd68lUAbGAOMkxaTOVe0v8v7iyXRyWul7BXlBjLhZ074wi6Ehatoi0w0J1jcPkcoosiowA3GgYhcsrB+4RcKwYZMlqq0wK4DdhkAtexDMeAIbRvIVPDEKTZ26Q6QDzPNn5rZHQzu/7TWFrcMXv7811O5AtWKEBoNiiPSjCV2SKsZ8ETTppqvp7xtrVTemrcvUrEIe0G/ocQujTN8ETPZR+qG0gScCmViIW98q0MS5Ea7KgHXbQYzzbW83u6jHLA= ---END GANDCRAB KEY--- ---BEGIN PC DATA--- wfKD6iudumBkmpL8IRr4U4exEVaoOXLtwDwmOrT1y1YWvOiWMx5GYaRdvZZBToZRqHYJ7ndWpLffTGqHhh5qBJzzs9MC7736UkGSDDniUJJG8/LFF//kmGmoAZAGLo2j5/wd2UrxMJK+iqKhTkS3ArgAxrZOOOiXrbnhbWMkLHQnbYuWlMClYZxYU6SDxpopRo5r292AV1KIZBZV4APBuUHcKSIr2MWMI0O1MKIP2IpKLE2TS5wLmpQodXZhP6M/UPrO1sZzkDbgjYlAG3g8l65nVd0/CBUxKQ7KDJYrtX0vSmnFXg/ykfgtJNiwqfCnqbr85+Bit7F2kR7B6OKt/2c2GOtwGopYbVqHBiDtqBHVEdAb8CcE4oG4b6a1Y8ZyGoyp2Q2iuJRzTRoqGlPQJIAJpJFswNcoAhPJnK0+Ce5dALefhGEwg7NrKg3sxA1KwA7/ZibpABFF3v3LN+ap1w4ZJ3RPRgGKcTnQ1lHgcn8bmQvf3SygQSZnxLJ6lsKw6HIIVY3pajeyfEEcPsAgPy9N3X8IQ3zC3qZcEuPtMkisBZ9MPJGmHt4OJb+RRYcPqYktV/LuurOUzA== ---END PC DATA---
URLs

http://gandcrabmfe6mnef.onion/d4f8919fa147539a

Extracted

Path

C:\FCJEMI-DECRYPT.txt

Ransom Note
---= GANDCRAB V5.0.4 =--- ***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED*********************** *****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS***** Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .FCJEMI The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. The server with your key is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- | 0. Download Tor browser - https://www.torproject.org/ | 1. Install Tor browser | 2. Open Tor Browser | 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/184a368050059089 | 4. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. ATTENTION! IN ORDER TO PREVENT DATA DAMAGE: * DO NOT MODIFY ENCRYPTED FILES * DO NOT CHANGE DATA BELOW ---BEGIN GANDCRAB KEY--- lAQAANGqPabyP4ljy+9nigxM3S5nWTAi7jV7fPSqhgRWb80yV6Vg52RatOAaEqEQiBBSbDQGEn2hXV6+IDgxSkZbDkEgFc0BlTvwt+km9OT30NFMioXnllQRDiwlQQVTs7EEYs+NDDHcNRW8aOoiszwRHan7yD3/RHz7VrlFheukr9WQkx92yqklKUDkbiqiG54HMlt1V0TYOcne1h/Tx4uNy1k2S/jWhbmfkZWo5FDJgVUj4q8ZW5Q1tshHurJbsV+X4n9RIbmSsLYq4d0XyJkF0lVa/84Fj0EWUDw2c7c+ZQSBBPmP/Gr0WX7Myp+gqHFzaJhoWyfVeiMetOFDv5ZmEZ+rlXh8pwj9wQunmb71tgVOl8TaiU0VgtccuTR9iwo8mh32AKe+7aeN5pF715ZEgj62Rjgfn9gY4moTr1nVILZ6URxzJe8ju/oGnB1DietEPrEZVKma5LYXQoxIgKh1ucf/EgNTy1Xuke9PqbHX8aTuB6OAuqj7r5FNZSM1F61AtogS/ypcfbN6qZSaHCGNH/ZOzyDrVyEO4Ogn+0if9QSHNMYCR0Jy4PgwlnqNHpMN3xkAhzlDATWde0QecR6r8hq27lwc/YRMERLRM8JksaRN2o4cTDHPzOPLiLYZsfXPn1KSQXRFazc4oaGXAYNSLWUiEhVI12K0gnDnCCJ7kqMIeR9HLpc0brWLzzeNHwG7063x+003UNSwwpuKQ3hc/ikX1oihibdVA03fppuc1lROkFaBWUvdGnDam6FPgnbyiNoAbCBogJna+rYk8ZcNoFCQ25qT4F6+eTD/11WpftT+5JF8COqPeClKU1y57ctJmp9Dv/+TELP4686TjDKq2+av6fSLbXH7OOQYVozGOttOruSZ1LYqezsnlJRRm7zpBTImjRepqzV64RJoVNMBcC4949dsMmBn+U1gDa/Ve+klC0KIluyWSXHY0+XwTt2FVYoOC9WAg7yE2ag480I/Ztu8DD+1JXIV3cSYKBryulM+lxA2gYTp9zr2pwEjxaGFZPf5loCP6qFQ4AsvSfuI8cYNjeVIrSeZLh/Y5MWItL1T17m35ZElAqY6cbK6NBY+KCwrfvvMFIjuLTxXPuaC+QPM8x96CZwXesiTfbJKQ1YFYcOluh40cL6bZw4EVZFPeIXxLqiW4F56UHJPkP5OtSUlLWf2nzBQR/WtwNovCRC2qN9icPE9Jz3HJH4REvnjB59WdJNqCAKNmrg+z0QctW+m3Ato++VaaxH64+8xOuJWt0C9PJ4GwSaIKM6uEwiiei7Kwj+873nlbymqCCBwqw1uGoS1NPrLITru9R6sUs8VGqbaFe/M6nBUpccj7x2BEc5PDIpANMZGKE/fEMvLA6FB8LVuIpxcI72SvBfa99tNcNozib6oXHnR8MHbCQuDeKqMj9yGLYMl+FPG4Q9KRKH6y7WNwFN6YFSG/duRKRNUbIAYrzkYiW2MMSipshIGxW59PmxJJOKnyq1V8EeZ67pPJ5OiJa8k0h45c16EogHqXD6/pfkLuCPR3RslaN3AaJ8Xw1jBqx3rwe6WXiVtejWyTTj8/IG5Wl+DtsewncatJR/E6MxR/6xcyMhW/CTZw7oj+315vabWMpOd/akGHA4hMuBO985vHHWY7Ax968Hxt8Q+ZnKtDl4TpKLIYVOG60B136N0d4VtE4tt67VYQrUQKPeiGx1U5tsohAxggIk9/xb+VNhFfSjXsKsRyHC8aUgRESsf2nqPPjW81XvXOdh9wYSMYfRa9izRT8aq3byu4614qvwPbPdFJtTjKUcQvVzYZti4eZuMDRWJjjtE5fXRKuxKb0vxAcUl7U7JVfn7SELLiotNNjytj/7+LnjTKFtOdWCfNzCMfo+8DwE3SoLgv28QTtnTEf3ld1/5/uG7T++vcLWJIzdzCO5ybj9uqfFgB1+ZRThOkAp5FUlYGzosjGbHJaiSYHd9OnrvGBU9yvM5UV5qaMWQQEiO3r5l/yBR4lIPIFmvkWkMZZWhH6I/8FiDfOZyw4AwJrNsGoDpIMikTADxNyQr/YzL2scAZ2G/npxDWEoKYICsaz+U9TdGo1qevWX0VsrNFh6EcEYJi8Vc4X3HY3GOkOnQmeH73yps5PHykhJPk7y5i46vwW2geLflIC63Lgc2I+x4OBukYfMtltSeiLzgbNzt/GdhTa36+OsWZwItw0lMLePtHSoNymklrd+vLZHlF+CqgodqjHgHGD/2XjGbLKxPXIIKMa9Aeg4= ---END GANDCRAB KEY--- ---BEGIN PC DATA--- wfKD6iudumBkmpL8IRr4U4exEVaoOXLtwDwmOrT1y1YWvOiWMx5GYaRdvZZaTp9RtXYU7nBWsLfMTGiHhh5qBJzzs9MC7736UkGSDDniUJJG8/LFF//kmGmoAZAGLo2j5/wd2UrxMJK+iqKhTkS3ArgAxrZOOOiXrbnhbWMkLHQnbYuWlMClYZxYU6SDxpopRo5r292AV1KIZBZV4APBuUHcKSIr2MWMI0O1MKIP2IpKLE2TS5wNmoQoAHZdP6U/VvqF1shzlzbajc1AHXg7l8xnT91gCFUxMg7ADMEr7316SnTFUg/DkeItL9jgqZ6n+Lqs57xi4LF0kUDB4OKh/2Y2EesjGtJYbFqLBi7tuxGOEY0b9Scf4qq4MaaXY7JyAYzW2Q+irpQZTWgqalO6JIQJopFqwNEoBhPAnKY+DO5AAL2fiGE1g6xrIA3gxAhKwQ72ZijpDhFL3uPLaOb91wsZMHQWRlOKajmS1hTgJn9imRHfzCz/QUpnm7ItltmwrXJbVczpPzetfEscIsBuP3NNnH9WQ2/C36ZUErLtf0jsBdBMMpGrHpcOL7+fRYUP+Ik= ---END PC DATA---
URLs

http://gandcrabmfe6mnef.onion/184a368050059089

Targets

    • Target

      50ab1dadecf027533a17ccd2f4c9fb571432285567c914fd81540b8fbd9203bc

    • Size

      139KB

    • MD5

      cb067aa3f71d1d59c9b91fe8b4632c4c

    • SHA1

      6a23e82b5da19caeea5b7b63cca00306325b013a

    • SHA256

      50ab1dadecf027533a17ccd2f4c9fb571432285567c914fd81540b8fbd9203bc

    • SHA512

      941aecd5c80c087767a69d7ddd589a69bdb424687d75fc406ae33e316b1543dd454bea833f0c302ec2227ff6986ed1ec9b1a12de64038371367a3dc8fe3ac0ec

    • Gandcrab

      Gandcrab is a Trojan horse that encrypts files on a computer.

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

File Deletion

1
T1107

Modify Registry

2
T1112

Install Root Certificate

1
T1130

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

3
T1082

Collection

Data from Local System

1
T1005

Impact

Inhibit System Recovery

1
T1490

Defacement

1
T1491

Tasks