General

  • Target

    39514226b71aebbe775aa14627c716973282cba201532df3f820a209d87f6df9

  • Size

    361KB

  • Sample

    220625-njgmlsacfk

  • MD5

    e387bd817e9b7f02fa9c2511cc345f12

  • SHA1

    98b3ec47b64198e3604c738f8c1f4753e0afa8c7

  • SHA256

    39514226b71aebbe775aa14627c716973282cba201532df3f820a209d87f6df9

  • SHA512

    2e7c93be406148d60c90db9f07e6b622e812a90e3de54b692f5eb18aebcb52df4649e87ad1ba8132d68de4817dd4cb219b784d679d8af3a69a41b0ca1f83d5a0

Malware Config

Extracted

Path

C:\LCPOU-DECRYPT.txt

Ransom Note
---= GANDCRAB V5.1 =--- ***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED*********************** *****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS***** Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .LCPOU The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. The server with your key is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- | 0. Download Tor browser - https://www.torproject.org/ | 1. Install Tor browser | 2. Open Tor Browser | 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/cca07adde9924b3 | 4. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. ATTENTION! IN ORDER TO PREVENT DATA DAMAGE: * DO NOT MODIFY ENCRYPTED FILES * DO NOT CHANGE DATA BELOW ---BEGIN GANDCRAB KEY--- lAQAAAoKi8hhbUMSLaHFy446IQvjcC4XFNo43l9IxRUFtirpJ3Ks16c0otyCnW+iC6jGnAR+rDVKUAgsyqWB63yNIVC9Kdwi2/AJxy0hVD6OIE2VH+8vBYo5f26jUVhsNKnj9tthlWkrnfEObhNXa+h+UcTQ4I+ykrgoqX+/pgkIxoLEkHAyunYKReuQ0ZzP6nChAASUtk2bhcaynwGv2g+YsJhr9bqmxwtvnW9fVwZ1vRaciDlqqy4jfQqmT3IzKyP8qbAkRnQ9IeMYTMFm4wDuZnZ0UXr3Sz8aOut2c4j5xVYQmU1mhYtxdKjCT4a9dy5f8gPd3UTMccAkqlwCmSOeSI3xy4TJVdTdA3+dvBY/mGTs5vHhio8kJX1cpegKNljartn9JfRw4z02sJMi/XNISHtFS2j0Q9fNtPhtpxhY2Ld7ZeKAWtYPj7NQISJ7kd2nJo9M9WPSC4gn/VnNYJ7iHDb3R/hJTeUUgIM/SSNvmrfraa19J17MoRONal2oi4oQhzlAlJ3LLDo7TlrOlMI6CJTMAPbE7665DzYdYflm7BsVLP7JhQuT2HxUZvH+cmB6HWe4zPZhq/xMsGVTojopNBtXrRibU6eh7msPDol2lx7MXsGpGIZ91RMlPSxJeGQkXD/+5IJbFf8zR1bV0z98tg2BRxQVsicatPPPY/zZ0UZbpIdNl7BlOfYfMo/5AS4v/18vXOwOtVTKA1abfLweCI2aHAFtZRJLVG7i1eOknC/zEQDpubm13gTDHQ3mW+OmXIFW4f8r1d1whamRDHaikM88EfrmdqQtsJOfpUeb0d9sITCW4M2QnSxFfmLABYyAyxyzHfh75NFWZv1b2iPnX37NheFKo2VJSyr4F8IbDgLkbi+ZOs66XGAQmItZLaxKGuH8NAscin4KNgLHjl2OHqaI/z+mU+zNueGBoS5wCKsOTqOLWpa215z+w1BFnrclxpVbQcaPzB6Gpdn5iIJnDxqTANXtkuqaHU41AtzQ4efIjAL1x+stpknfMhwjiB9QZwyMAuWx1Iw2U9kJdx05Aa1C+mHF9v9a/Zs2Gl5vTY57ihoiB2/uGSEF5f8/He33JhKl8DOynr035d8c5Vu+SlgNq32sNjKtWitPb5CoUxTrQDUQeactRLRTTzYuDavPmnOK9GWvY65RNINGcowakdZJvUHprkxSqrN3Lo1rVMJjt3yi7W0zn/yYuR7UXeLKqDt/dc8NmP2AhEdPPSKVjaV7QQffpfpl26A9WgZtAJr19HIDePtq7A5PxbmzFzicN6ifg4woF1UfOxbiqUpTyWcsghckFEPYuIMBRrtQJmJ8aWvs0gTIQkgIYjnFUKtVGgcPzjRNkWeT18MeV1vECLOXMJuegZOQx/37S7UZ5Bkxsvj+fOpoT+GiXzQ/NH8ahi6/L5BHCLZVy0ohAq3yFcxSOWu7mOms1xtB30aWwGPIlS6Cyym7XIseczB6sjbW1wboSWntEQ9Mf0ES4+BNqSMrvvDlYZZHVGf10cfVuM09O4wdmEWRcCAWd/KHNnevzcaf30qbaU/HKRClUeyQejAHEfhSp+0goY9PEgWODvViWiKwTZ3Vk1LTF3z9ZpjVwTLtyL0SgP0bwVuxwLBr/6P+mNGXg1luFdhK9KHu1KoK+cCk+aGaKqcSl1GkqaTyo0HVSM6AS0A778wrHa+Fnh3Ur+KN49dG4BV5H2vmePGrbXHz3yLo5B5qltkDcPYLOx58YXGaDfhrOFqP83374v29jWtUi89qBMmW7JF4M4nOXW1guUijPPU9t5PKOyh9ggpJMRTp6YtFzd4va8PpERnyN2IedeTRlwA2eavYzjRD3wd0L4f2mh+WIEgXRbIvTg0dl4HUY9nWTr6H1JUBVJn4Ps0CjRkwx63+FIWjCSAhnWvu+GRffzQkl9Wh4nd7o8XF1CUX6UAJTHHom38rQnT+9eBKXxNy9WdsOQdtwBoPdnVtQhliPsWS82PQqMQo90Rxv5UIPt9sEFkeODV/ABnlQ+TnQcBD3bcJ2ZD1G/r1pNDcm/x4yJrPGdF7ZKITZUhR8c8P77vJpQ/jOUyMvHtNwuO/7I2g8HRjUDrRy25e8jp1SVa1iLH7gag7TXVqFezMmh966pc8oE/3yAv7Dr9+zjr5acyv4DBWs1TSG943aJkKJLe55X1oAM/EbcInZhfedLmKcbUAmzKz+dkE8Ap9/zRlHcexrrR8uu/T4BlJIHf+QuDOAaXN8oEgrN2U19tVGbY= ---END GANDCRAB KEY--- ---BEGIN PC DATA--- 7ftDEgLb/ZS0lcmZbHM61KDJ6AOtD78KkA7absMgUXYxWLsC+5+UYF9xVmDq9MrJNJDQAueVsuDNRWPIKnQXQzua3LPyzokSUuglaqKXwabsGM4pXku5In6gtMQMqg7sgEh1XW1iPMFgiUj/s1LdWpJHdiPjMpn7rCZNO/A31mak0K8RefoREu3BxtlAsseHWfVIIKN0U4NnA3w0Ga7XDLlF3iOIB6ImYbF6Z/7MBN2mgBr2rZ2mU0R7+dxfWLoypoW25ypHEnKnMMuBl1Cmehqo5VrrnNSZu19KSVzOtTAymPz79ICyGBkpCKj0RQwVePfN00RSVSCWtOuJfdAKBnVq+sZqR7W3OLHFmdaRiEfSP9ry6vM9LODjDaPvr3tWv+YKTznJt/bAL0J01/eNSzWzh6AvoTXFr52GPDOx4ShKudHoMloV6iCVz+mqqBhva7wHrtwyoS8H1f+lWDmX7rl4X+xsgTSwPkzRb4Qf+twVLTqjx7iLwAji/TPeKPyghY2WWLL+qAlBvGyizoECEqZE6yM0AN/h29QUIFj1AUHIyayMN51X1lU/9eRAez4EhHTECg== ---END PC DATA---
URLs

http://gandcrabmfe6mnef.onion/cca07adde9924b3

Extracted

Path

C:\XFTOO-DECRYPT.txt

Ransom Note
---= GANDCRAB V5.1 =--- ***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED*********************** *****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS***** Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .XFTOO The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. The server with your key is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- | 0. Download Tor browser - https://www.torproject.org/ | 1. Install Tor browser | 2. Open Tor Browser | 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/dc0aeaf7cdd93a8a | 4. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. ATTENTION! IN ORDER TO PREVENT DATA DAMAGE: * DO NOT MODIFY ENCRYPTED FILES * DO NOT CHANGE DATA BELOW ---BEGIN GANDCRAB KEY--- lAQAAOGMQQ84FsOtr+7kQrOrG+oamZeiZIAXEqkIpsnEDbO5wVrDjBACP4FbbWlS7rcjWF1M3/7P4jZ/9+HUuiy9/K47wVEcXnnHmgvIauXC4NS9PdjrkqzXbqOwR2BcTHHqDwPBlTAWPARzhqQ7NVPN/tQQ/KS1Rov+uN/R1Qoh/W8yLtEgPBCl0Gg8yv/2FMCH/I/LG58ZvibwxziObRE/Sx7WSO/2N1nm2Hv7wCoZgSJpWEmJnmKpQ1a2JfbIqBecrGLKTyvzERLX1M/8OY6nhsqvMrUY9nc2CvsxwGAeWfvBrS6P3koiOzAYLqOvNuATVpYpa/cFCFpN2VmSdh0HikZ4YWrGAmTTMKTwQzfQv2hoq8+Ym1a3oTRYWe68Ygqu6hdKelwJApzorzFcKJj2NunBYvgChWPv+IbG0eOFLk8KFkjJp42cmduMuPX8oWnutAwifpm2gbTD8TqB3NGS6+Ip54FGmFLva396SvEYqDHRp9QPyj5zplcLaR5lnpIrlqZEyuLYfQb/uA1a7qGUEZtUvcYL9ILbuZed/6mulLt/qszo6sEGxBasW5qcXUPbRi61pNTllOqIQFBCxjcg0FSMV4b6+tef9ysS//RU/+5zDGBwL+EotHr2pZMA6zKC4B5xnrJT1Dwk+XKh4H1V8PoBrLckxHF83Ro9igQNBs5f4Hsc/s5AxHETEFHz7yX5GR1VarsWlqksonMSTDF+NlwK4vCg0p0wZEQTkOqh3+rDPrJ6iTiVpc1kFPIV9aJ3n8/vVKEot1d8b3ySkeDdn0tajXlt3u2Q9P1OwVgXpLlkg5hYX60tClB6QbmW8bp3asPAhC0pL0xcTTeGPg7I3BLjyQ/X/UndDNox05WagfW7XK3Y2FMMsSMzwLpFFj6u29CcgylHuLostBaQJsyKAjmy4kZVBM9wvf+74X7yjqxXZFfdxYihxPsh6gcoJgr5regRmqxcbrf8oHVnM1XGLhd2lt33xF9FbZnkSImZr/Bfdi0aeJt6jJpMYRXCK2IjbvKdO5k92ydgcvfM3duDOI6svisHfr9kSRU9xp0yY4HhB/hnxqPTYGhp773C2bqR38Djt2LAFhlIZifSl1an+1y8SQSKSARQM118T1NlwQEJ5wpGdTG5hOipL5gYN53ydrbO4X6faf11PYyPHL6z6k1ZC5TmrUHbcO9RgExiFx3ELGLl+iAtNAStsAsHdtzNAunJF++E6s7etNfcnPv/WYpnSIxoDJFQy43u3+k7s/twsp3ycYc588Ut820/b8uE7im5OBL7h2p7os5hxgBn3qdkm7HOHIBesZf8fss29k7lFcsbdvt3n2u7yv6gA23QW9fnFaIbSk7EG9QVFPBDx8r6CvMXfu2phO+d+nvFkDz0Qbua6PeP9PFwSxexr4R5mKQ4Xn/HrbhF0LSdOhUqi0sQrc1X4qbay8VyS/TssiDRnSR12ss7QM/MVfHZdQILnFcXNytefLl32ZDzL/UolVXwBNUgwO118enLukuyvEkglro1HdnUL5iPOPPcsYw7EIc2RZbV5n0C2ih4M31MBBnbK+jwSVnt9+DsydC7YYXcQxI+5O7chaVfxA7NVVsul0YRWPrNKxmAxQpf0kU5puXQUuDvPf0sVHGS2u6iXNslrjg0Fhdr1c0FMrB83QxQPEWxqqyzPy3Ykoc/AK0TOP1JWoG/DL77AJYeGzuxcBa2QFnL0qnY3D0S6guQf3c+zg94Q9knwZidpbaK5k/lR5Tw5rgwxa/K3QdlFSyJzaH4+hhh8GRztKhACF2BBTyMLfwypO5PwVjgH5hNPYTJ0Nu85KwNNtWfu3q7GZNKg6ljQ/23wyeO5VnhptcA7g03IfGhHm67yhYy3J8jZK5fCeMipIiw1fUXjJO/mJnZTY8S2piDzFv4EAcW5V6llDbbHFR2HNPZfzC+Mg2jf22iGSFK6HBph+9uoB8GQlU0LufXe9tLnaGfzw+bn0DzE1DTRTzN9eGrn0DD/W558jXULqH3VgEE7YSjC8KA8FXPsE5NutZJoawmm6eh0BmKoTrtI5aJHIWXz70rtUN8nkrKDqh4U/+lxL3kwS1FfUXU9i/We9KH2Cdodbq+BUPzvAaqTHkzpK/xqZkxBjdFYnZnfw4r5CujCCmaIJRbQXqDIlYEuplgWsyNNGig92pOG3cVt33YI62btJOkSx1+5MuGSccfOx/ejfWzOZs1y8xDJLpv9klApKpzpvn6/IZBjbFsS4SGBz8= ---END GANDCRAB KEY--- ---BEGIN PC DATA--- 7ftDEgLb/ZS0lcmZbHM61KDJ6AOtD78KkA7absMgUXYxWLsC+5+UYF9xVmD09MrJNpDSAvGVsuDaRXvIKnQXQzua3LPyzokSUuglaqKXwabsGM4pXku5In6gtMQMqg7sgEh1XW1iPMFgiUj/s1LdWpJHdiPjMpn7rCZNO/A31mak0K8RefoREu3BxtlAsseHWfVIIKN0U4NnA3w0Ga7XDLlF3iOIB6ImYbF6Z/7MBN2mgBr2rZ2gU1R7jNx2WKAyu4W+5zlHFnKwMISBi1CwemOo6FrxnP+Z5F9bSR7OvDBsmLj7oYD6GBgpBqj3RSAVfvfE0yZSXyCRtLeJKdBeBiRq/8ZrR7G3Z7HLmYeR2EfUP9Dy//M0LLzjCKP0r1BW4eYoT03JrPa/L0B0wffnS0ez96BFoTHFqZ2APDWx5ShDudroN1oI6iqVw+mvqAdvYbwHrtgyoy8P1fylXDmS7qt4D+w/gT+wIUyBb8YftNxZLWGjvriRwBniojOwKKWg042SWKX+7gkWvCeim4EdEqxE9yN6AIPhmtRLIEP1VUGFyemMeJ1Z1lg/vORKezAEhnSVCrHrOtcUPBaV ---END PC DATA---
URLs

http://gandcrabmfe6mnef.onion/dc0aeaf7cdd93a8a

Targets

    • Target

      39514226b71aebbe775aa14627c716973282cba201532df3f820a209d87f6df9

    • Size

      361KB

    • MD5

      e387bd817e9b7f02fa9c2511cc345f12

    • SHA1

      98b3ec47b64198e3604c738f8c1f4753e0afa8c7

    • SHA256

      39514226b71aebbe775aa14627c716973282cba201532df3f820a209d87f6df9

    • SHA512

      2e7c93be406148d60c90db9f07e6b622e812a90e3de54b692f5eb18aebcb52df4649e87ad1ba8132d68de4817dd4cb219b784d679d8af3a69a41b0ca1f83d5a0

    • Gandcrab

      Gandcrab is a Trojan horse that encrypts files on a computer.

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

File Deletion

1
T1107

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

3
T1012

System Information Discovery

4
T1082

Peripheral Device Discovery

1
T1120

Collection

Data from Local System

1
T1005

Impact

Inhibit System Recovery

1
T1490

Defacement

1
T1491

Tasks