General
-
Target
398ab45708e9395b94c10786e1d4578c3868d6adc4f959c3269903b0b56fab25
-
Size
493KB
-
Sample
220625-lv1hrafeam
-
MD5
18bbaa35e26f6e55c5cb7ef6ffbd6c2a
-
SHA1
620e5ef2ecddbbc0132fb20e78c0c8d768510d60
-
SHA256
398ab45708e9395b94c10786e1d4578c3868d6adc4f959c3269903b0b56fab25
-
SHA512
48b001a0eb7f3560f6d7a40acfc1267a4f66d0ce0a5ffe0a77423ef5c241c2f94c1cd819dd0a6dc4c8e3611a7b531caeee181e7a4ada3a5dd9b227f5a03b966f
Score
10/10
Malware Config
Extracted
Path
C:\VJMIS-DECRYPT.txt
Ransom Note
---= GANDCRAB V5.1 =---
***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************
*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****
Attention!
All your files, documents, photos, databases and other important files are encrypted and have the extension: .VJMIS
The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files.
The server with your key is in a closed network TOR. You can get there by the following ways:
----------------------------------------------------------------------------------------
| 0. Download Tor browser - https://www.torproject.org/
| 1. Install Tor browser
| 2. Open Tor Browser
| 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/9d1228964bb1a00
| 4. Follow the instructions on this page
----------------------------------------------------------------------------------------
On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.
ATTENTION!
IN ORDER TO PREVENT DATA DAMAGE:
* DO NOT MODIFY ENCRYPTED FILES
* DO NOT CHANGE DATA BELOW
---BEGIN GANDCRAB KEY---
lAQAAPlAsYc9Pqtaci4eCfTmI6M6XHd+Cpqnbu9kiatSkn17eraGfKzUJGGQtJOHC/Et6aJhdLT5BDGoYoJS7wTwpbpMH7a7p0REu6gXJVMgVsgG79uDFz5S+YXsL4wacBqNPnVjXLYe7rUskEKGMOeNRuy/Vet+4PIHqr9VRR8WhZikZQK+ZAuX/ZHbUOTPDhfhCDuXCFguDfYwOYUsHFfMaSJ4JeNRoEoCRXxfz0E9CLrwfIWKW3Wadp+sb7v+TwL6TQzLa3+BBVF3bpTzwIBgb4LJmVLP8C13uxslzIEIfcIcGNNgNufMNlMJuEOTWRS0HM9ELEClcnylU0qEpCF4QwNSTRBBQxrH7zI6cdGSz3kOh8ZhkawqAvbjFah9c5KBXtDbD8SZPKBDulC/6fs3oXUnzfyaHc7QAbSkeX9g1Rmita/oKD7Hp18EsQXO16D+Sx3vAYeYVkeClsHU6PK3CldFkWm9E/259A6+BPjL3KiT2WAdyJkNChC51d2JhQJDwkd7E4gED4fopDZXPPzQJ5WxWrXkONlolD/Ja+bXZhm7sSDj9VBA8PbyrJIdUDF1ZjFQRwwNOPrXBLfTm+cl4IA8XtsruyD+R0hCnE3D+jvt3blxJBr3cowQ1iSM6C5r7/rXNV53dXgQOr5yslC1T9iKvHBryfK7QbkZSdAM7/6HP5mD2FJ+dWMcEYfcR8zwCV4v9lIu/KD2HmLwlW1c/GB1pRz7BHL1lKeYA/4RPc6M6KMi/1KWSb2Q/CeCjNFdSL5ujTIPbwwo6NS/21lIB6Bv5MN5R5N7cGXZxpwBoYlbX2gT7k7mx5bMGCBIl2L5+V7vSfhyApxryRFBIWOLYfwIa6mly4JkPq1+V6NOC/dElgbNfLoCoVnkQT07+mGlawobm0t6lA7wPsI4NT+mSb5g9ihxOrwD94s4qcdjts/zQ/5q1SPDe4XMYtau4FFSAmRMOCCIJSN6SQGBIx2ClIjg1AMfZA9SR18OclOrr2LFmYzmThtV9iHm/JC8wR/UnwqEmgjRyuqXDdNCb1mfCQBZAMQqxxHSL6IBvEdlGPgOUFRlbEm7RmaOM131J2xRUUvj/LfG7X6h+avMfpfCK6bnDNaZ9h+xTr63eXYl7jYyqiLM/Fj1q6DTEg81KJQYrVztVX+ENAy658eAVbaCAlNVwcJbcDrMk1vrksjEFytOwXPS7QC5RAUQ5wqR9dubMsvCu89X8V1KlnbP9ogQFoAia5hYQHHRH7knBPn45try/S2DZBx7obOMmJxCmMQIkB5SukS80KSi1lKc6c37TvXAEpI5VBTb98azv/FOgd9K2e3QLxDmxjOqzNubtxLZPiBp5ZrSkpcDj57otYq1DWwLOxm7KTgp9CXB51SCTobuaVh64nErtsoacz8aowb2TruwYTD0x0UWGcd5Yi3dUDyw4JAlu+Fa/og3UKfpTkCWSGSp5zXkAxi+tqCDl5J/W79aCsJvUHoEe8O0DmW+OeNp28F/GN+6zCt/nHTgMmDZjrRIZVD+QvvpcXxL3m2EAk9eYOvRG2AT4GzK2btQOf8X/qCFmsIk+4WMjiG5iH5pXRsDSZoaiziBplmjn18TuPPRmjWczlvws7rNzkG1cRK2+zrz76uy41TRO7byYTUZLA2TSM7phvhs3lXHxeaoGwbhe4ogzMj/5aZuVGaw8Gv+OMatcfm96R2tWEbCeXlwqSa4Q8nGOy8BP3Ka1aGyiug/uCDzckktG8XgGAfxrdIae+n40m8uEmLME+q0rGJJgnqrEtIxeNlPOvaQFFc03a9eG3Miz80My4Jw6izApgxjNevLwg5M5fDQkToDFWE9XaqtUEfjTiCvyJFyWVxz0D7n69rBujPYq8NihV6sAgU1JqRNS869LEJQQTI6oPYusUPUpte6SlFPqTgxkd3ZZzUtrjvkxwURPIbpE+es+S/52YyqOse3nhA7C3g2VV3RIKXvALr+7FKoQZxUebJNKGtvmCleLda3Gerx7j9HliNh0leRP5VqUz8VpSeP9IYqlEbdFFGopoy+rFJmuaPhlt7mjvd0CfsqRCUzmETBRbSFINX5hQMj6j4JPZDQCdO83Yt7SGmR2IocXXdUiPlp/bL98VogmRzp3q59SkYg4vlwOdXkYFzgsIVVRZzpoTxYViyNiGnL7F5LmLjTKkfKqUPoGXNc+33evG6gzDkuRF2Rd4D3qTwAmxqskbqUXaECiSM2UdAfACQzPRMqi1are5W63hI=
---END GANDCRAB KEY---
---BEGIN PC DATA---
7ftDEgLb/ZS0lcmZbHM61KDJ6AOtD78KkA7absMgUXYxWLsC+5+UYF9xVmDp9MXJJpDJAuOVoeDXRXjIKnQXQzua3LPyzokSUuglaqKXwabsGM4pXku5In6gtMQMqg7sgEh1XW1iPMFgiUj/s1LdWpJHdiPjMpn7rCZNO/A31mak0K8RefoREu3BxtlAsseHWfVIIKN0U4NnA3w0Ga7XDLlF3iOIB6ImYbF6Z/7MBN2mgBr2rZ2mU0R7+dxfWLoypoW25ypHEnKnMMuBl1Cmehqo5VrrnNSZu19KSVzOtTAymPz79ICyGBkpCKj0RQwVePfN00RSDyCRtLuJf9APBixqp8Y4R+S3Y7GemdWR3UeAP9ny6vM9LODjDaPvr3tWv+YKTznJt/bAL0J01/eNSzWzh6AvoTXFr52GPDOx4ShKudHoMloV6iCVz+mqqBhva7wErt0yoS8G1fylVjmX7rl4X+xsgTSwNkzRb5Yfr9wTLS2j+ri9wAXipDPSKP2ghY2WWKz++AlSvHuiz4EYEqBE6iNnANfhwNQLIE/1RkHKybuMKp1R1lQ/puQeezwEiXTECr7r
---END PC DATA---
URLs
http://gandcrabmfe6mnef.onion/9d1228964bb1a00
Extracted
Path
C:\CCEVSKK-DECRYPT.txt
Ransom Note
---= GANDCRAB V5.1 =---
***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************
*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****
Attention!
All your files, documents, photos, databases and other important files are encrypted and have the extension: .CCEVSKK
The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files.
The server with your key is in a closed network TOR. You can get there by the following ways:
----------------------------------------------------------------------------------------
| 0. Download Tor browser - https://www.torproject.org/
| 1. Install Tor browser
| 2. Open Tor Browser
| 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/7fc0c866739bc74
| 4. Follow the instructions on this page
----------------------------------------------------------------------------------------
On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.
ATTENTION!
IN ORDER TO PREVENT DATA DAMAGE:
* DO NOT MODIFY ENCRYPTED FILES
* DO NOT CHANGE DATA BELOW
---BEGIN GANDCRAB KEY---
lAQAAJOKrVCcE3EyUpraIm65cnR0AE9edOkWSYrHsVRx2dJA83ZRrAMeqxXzGacKGmsmNld5MIYHspfvLvILEt/4TLjp+3fE1GIPVgLu0GoZbMDnA45LFG29yQO9gOrLThuaS1VzvsW9x1g3Js1DSHk9aqVt61MJUkFofKAjRtAbIN7dTFLfqZHLsDbYtr/llqz40alGKfqfgZeiuNPaD8attF+wKcWJ5WA3f0aux9156tSIqLDidfAtdpRbXAXfKskn8BvvxNzfMVhJawZ01NRaHltpO3YyQG5/uC3xLnH4+KbS60PzWSP3RYbXr69D9SoSPsW3GzOajVatgfmLObjNg3Ny5LwM/DJ3E4s/IPdWJjBGF1TqHiBw8YcnYCctivXXZx1TMypyVagDsOxnCEFjEbeCgpsJ2Lwv2OlKeh/sK8gg4PX0PQpsFf5qi128QBlKGirOEQOW5OTwI4y/VOIHEZpNrKweEI7wGLn6L8MqWV5Y7E3s5VUmRUCBLSpjk7Chpx6LZR9fRQHXV2uUHJ3/7cNtxbrmqJVIXEwoqZ4yk0cYGdIoEKA0F3FsmavTHRbjCPVQHAEwIJmn8fpfeeG3VCSXkmZc3quFbeBAY1s9fUsQLFRBgzfCkoxbAKmdXPNhExMyTwxeD1jMdzrOjIr8elbpWLTluBqn8ZTQAJpsfa4TKSH5BHtVuoxFVJfl+mCOFwpn5VnnCKWK/Nqxpzs23ekqBYi/8oz9TtbchZ7HDsJHBDmyvR/rlEYZXftelMXir19HoTQguFjZWMZhDQnUIhqlDvgiy8QiVFXLxkR8va+2lGr8qKcd1Fkxsw75Hfv+qLLPny+yaXtVC5YPO5n0qOzAkAzLsCSP52dBIwzVL/xrzkGdvsnGEdJuXe08oPa5QstxCsow5W69q5D1BZXh3kslwtA4lJYdvXuSmRyjkXNRUovw8oF7yaIiMP7OZcPrL9ctLpd/uW8xqcFktfL13FwT8bH+5Ck+5VE3RNcVN4ILwBtj0syeopl19Pt9rFKO7JezbGIiqnrY5sYuWDZUMILTZ7UMFly3wmj90JzkdugbzjA0Z74PfqsSse01jIKQFZXETa3MRkfJUrdAiJXMsXg9o73I1THc9nFYR+GR7YovYrbO+D3cCwNkKmnUeyJagKKc5iZY0xXFyw7BbqYaefA1CJyGGoI8SSuRZ81xwNwqNZQnSQ08ngZzy6/D/nNigTJ+hX0PjIMONnu4zMcoXIztV7CtI8rhmXlSVb7gxiPZ5tNQ5ZfCfy18oKo0HkftUcR1OUt/eEiEpAYVv5MFmeLnWtYEmpji2bzrkz8WSh6GZmqkWPtTfENAjRDVB9fwxfSDQX+ihA7U6MBGsoaVS5MUyTs+YzKBucrMO7RbjygXS99gsFkCsRrVHeomd14M8dPgFCWEAYm3naRrFKvY3cwUzuOuzZGmZATds8MI2tvDwAaUuqkpJweMf3EXUZ/RJ3mPZMNUEoWQaNXdmsGfNfLHlHiIxr3tQAkmfkuZs/Fm0ZPkfABnzvOPb+yOKuh2oYnQ9UNlZ8pm17Jj9RlPnKYKeEWILVXKLwcoq0TN+iomTo7amrm0xkmTCWz3xoJzqN6zlYnqXmI3nSdPeLLoScYVqcLIKlFuuaZewi/EReuavypv73jJd6nc/mOlG27rmJOoZrd6UJQY4pGAUaIMIQouoxaNx4OB6JP7QNzp4dUf1vuV3WGoSRnfgiEfh9shpl6t62SslwChN9OPTFyRZg2aTqM5ua1XuxvUlF84FN3vYEk+4sT5pxx9tv79Rutdo41/hnoFIy7yFCHADHz6r3lDCUqf/qKhjO3rBCdxYBTdZEu6NsdbgzcirSSjgBKy+A3cm40NgA9DJ1tk2GvywY7PnhEuOPnUyV24Bo5uVoocHGjV5molBro1R/xG5NXLwDXm69zr+aTCVBGERDm3QurEGWaAJhyxYh/wIXDPX5aRFNoxr9bgDLI6ZxbL3GytMk4cZTylPX0SJwsUxEgYrvY3r6lVtKYxyYskq2G4RXxtKpnXDeaBpmX+ELgyIutB7G2yrbnt4ozaogfeEJaeAEOd9TJzWlJChYNQzJ0MYdXAywiYdCW8J11yS1rsxmrGqcBTAkYPlBpVjh/MBesPnRniUDkb+xkulWvp6k9GD8eJBNxdM5GY2TDwu851y2Kw1awRqNzKepjvg5DIAuJ/2Osv6NFV3szTfuZQ75kFub6r75y1s4dwZPvVZY2mJMjzW1fkHwY=
---END GANDCRAB KEY---
---BEGIN PC DATA---
7ftDEgLb/ZS0lcmZbHM61KDJ6AOtD78KkA7absMgUXYxWLsC+5+UYF9xVmD09MrJNpDSAvGVsuDaRXvIKnQXQzua3LPyzokSUuglaqKXwabsGM4pXku5In6gtMQMqg7sgEh1XW1iPMFgiUj/s1LdWpJHdiPjMpn7rCZNO/A31mak0K8RefoREu3BxtlAsseHWfVIIKN0U4NnA3w0Ga7XDLlF3iOIB6ImYbF6Z/7MBN2mgBr2rZ2gU1R7jNx2WKAyu4W+5zlHFnKwMISBi1CwemOo6FrxnP+Z5F9bSR7OvDBsmLj7oYD6GBgpBqj3RSAVfvfE0yZSXyCRtLeJetBbBndqrsZtR+i3N7HKmdORj0eJP4vyr/NiLLDjT6O6r1xW4eZxTzPJ1fbDL0900Pf6S0az7KAooTTFqp2BPDax4ihAudvoNloC6iuVzOm2qBpvZrwBrtsyqy8B1fmlXTmT7ql4DuwwgS+wbkyMb58fuNxZLWyjvriRwBniojOwKKWg042SWKX+7AkdvCaim4EdEqxE9yN6AIPhmtRLIEP1VUGFyemMeJ1Z1lg/vORKezAEhnSVCrHrOtcUPBaV
---END PC DATA---
URLs
http://gandcrabmfe6mnef.onion/7fc0c866739bc74
Targets
-
-
Target
398ab45708e9395b94c10786e1d4578c3868d6adc4f959c3269903b0b56fab25
-
Size
493KB
-
MD5
18bbaa35e26f6e55c5cb7ef6ffbd6c2a
-
SHA1
620e5ef2ecddbbc0132fb20e78c0c8d768510d60
-
SHA256
398ab45708e9395b94c10786e1d4578c3868d6adc4f959c3269903b0b56fab25
-
SHA512
48b001a0eb7f3560f6d7a40acfc1267a4f66d0ce0a5ffe0a77423ef5c241c2f94c1cd819dd0a6dc4c8e3611a7b531caeee181e7a4ada3a5dd9b227f5a03b966f
Score10/10-
Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry
-
Suspicious use of SetThreadContext
-