General
-
Target
356bff6966ca7136a8486089c17205ba4b50fcc7f60655d82103dedce4473e55
-
Size
411KB
-
Sample
220627-ajwjwahhd2
-
MD5
5809199a0df6e392aeb2cdc1b519be5d
-
SHA1
cf3460700ab3a10a15b1faad3bbbf413a312ae92
-
SHA256
356bff6966ca7136a8486089c17205ba4b50fcc7f60655d82103dedce4473e55
-
SHA512
9de122e2b29db1ff3a348a4fe07e22b3e6c1b0bad0c3f85776f3e6816d486887d1d4747472e16df524c4e9de2679659b841884f1ef517eb14af05894eb378099
Score
10/10
Malware Config
Extracted
Path
C:\PNUJLK-DECRYPT.txt
Ransom Note
---= GANDCRAB V5.0.4 =---
***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************
*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****
Attention!
All your files, documents, photos, databases and other important files are encrypted and have the extension: .PNUJLK
The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files.
The server with your key is in a closed network TOR. You can get there by the following ways:
----------------------------------------------------------------------------------------
| 0. Download Tor browser - https://www.torproject.org/
| 1. Install Tor browser
| 2. Open Tor Browser
| 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/d22a53b8f5ab3a2b
| 4. Follow the instructions on this page
----------------------------------------------------------------------------------------
On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.
ATTENTION!
IN ORDER TO PREVENT DATA DAMAGE:
* DO NOT MODIFY ENCRYPTED FILES
* DO NOT CHANGE DATA BELOW
---BEGIN GANDCRAB KEY---
lAQAAG+9GN2jEmn1F8BcvMJ8klAcuBmv+9VYbLAGIWez5BfC5wzIBifN30VnFQQZMKycN4tABwy0k5JaklLPPqCUv3FXX4pgk86yzeK9Kw8d1l9TzlLaUX4Tk+aiC8LxKeKTj+vcUrZdBoh8lP0C0KdQ/qxpcnluFDGYQnTexwdFUXEICaYfJLoYjt0e2wGIJ3qrH/jWu7GZENUgfetx0VwI9KULxa5lsuDaDDWw3TYNKMxm+ZeMw5LSvZARGEUdv6J1m3FzMzYJqfsdrJo+X8LziwdLVdxbbvKHkbET13rwHN9HLpL+FncMoUoJkW882tCET8eDGtqaoKHhUMUO/rexPS3cgMUt5Lgr13pZ9AxyG+ECcX8odupc5n3A1+QB3a5EczpUbVGRv06WlElvaJCRXcuVBzYb7CjBbxSttQHpVPlab8PrEFpDXfMqQkAoetOvCkVRi3l9W/ie2rqyEaT3/t2wPhWduvh6TEN1dxLhINN5pDfeJnYrqkSCHnxZ0Q0vksjj59W0TBUcPqc3jpfj2i0Jux86l7VtMqxDQoMJsVckZhlYOiaAIpTIKP3KImb8W/isKlUzEPMF+TXuSOfepY4DF6OXVpIE1Cx/nWKPF75egB/lQzWeVuYRX7VMS+fzqKuaa3sWB9gn1Wrd1fYanjIw+zKw+1Apib5OWHZ1E21xgiWNKwkSdUCEbddMQWw3fDdMn2zZqBYYbG9Oc7A9GzO4HcO1jw4WLD4UC5PeBpnf9TsC5CPaLXu3kXVZ/6wI4en4kH5txl7D8kJAI9AoIfCmVzq23Oh+F9uVJj29Ia1E943Egqz+X77Ln/jQ4E6mtI+31VxaLMfEaptKFkVhTjYaZ+/0erUSjtQkQiVmnHnpdPgz+wSHYtix4a6Tn8FOcozWziMFmj+jzM2rkgXTbQUfTTUijcsyzhlZy2e6AzpDyOKK0ZeeqfNG4iW60toGOw1yvy9jtaTufMLL1nD8eXZ9CqEBWWM/a/EZpXFElD0qx40s9k558ZvU/x1vm9x1+qwDvEL4LNTfbsmM2bpJWRs8ATXs3p5CLf88fJnEuHlqp7ygg2SBihSjkS/DdA5TzS22PZz2GS3EKwYcTkrNDSHMjm/62B3MGZ1S3typG19FYt00woV3ONwHpzPSUyxj0En0ZhjCnBnINCfY7MCOGMh0ElwTtEinDnRleqBqRw18aR4gGIbAE/+GTktSPZ/Ine6+iV7tNWPa5oFc2uV9gABomgYo2xChn1tvEToM9OMsRfKtq+MvVql6JL7+/MWC/UjboHqAiSQTrUpC/VWPbWCSpK/uxbOpFy5L3YDxtOAd292C2CbS/rdeU+9OzxTO6JdND45ubEc9/Zs+pbU0Fn8HUw4r9oWwd16qPtM7MUcZExFDNc7dWmP5DjHx8w2cmCKkq0R0FkOk4ERqDeGW4aMBxkgaFnust8ALHjfBuMFbTT6AXFB858mPZN7zOIz+mLtsAOPYujbr+rvNa6EBZnDZ8KgYhbAEK2r64LMrvXvO1ZsaSZzzJ4a/o+UZpm6OHUTkkkcNEmfEdgesMAcwUBIW5oKeklq4t3wYHb1rzs0A8ZoVF1+YJAXqavGPVr8G1HfjNcbHQ35YMOFXu79erXh2lKFuvCPWXE09lIERkjBUE/BZLmQH4XGwnF66B/0jyKB0BUJHLfwUFwD89rnegL7eKvwSkBH8fYWd7KV64rgfj7jOj/GPovBA35Gr+XbN/hB0ogD1XGYYocLA3rbP7+ERWlZU/hDdMENGuHd2oKVvaj2ZSJQRpGIiiiNbJlIuRbk/jwamb7E8FXYhbL6AWmXVCx2pOsR5ZsBCeLn2CQYCAuLiJABgzlG9bDjd/k99dAcgtize16L5Oi/rw/o5FH5FF81+vR7lQiE21Aanxy6ZorbW9Q/GW2HlQIUQ5BSAlJd2lJHXBucF9Ql7n0IZHbrRnVHiI1eovvC8sWk0Uld059e5KiIppAhplu9pYSu0u+TDUi87UEBRvtNkIPx1xF4NoMUQ6iSHcCYgZMfZnsWqOoNz6bUtUTWYysYAl8jH8RSToJ9WatLM+buJ6oB+W6TjpNp+65u98rvCQUgnMt4Zceo7Ar4+lwz4p3fcaZ3BCPAzZMIvdht3mtUZqSKWgsBqTUAOF8SNJ04sN5GNjGmyWUgzvpLy6dDTofr2jwvjgEhOhi90xDzbiLoyzar2jKO2GfM1LfjZwP1haKVe4kFLyb3+BNqufEfYOg7cTed4KKAcQD0=
---END GANDCRAB KEY---
---BEGIN PC DATA---
wfKD6iudumBkmpL8IRr4U4exEVaoOXLtwDwmOrT1y1YWvOiWMx5GYaRdvZZATo5RpHYM7n9WobfCTHKHhh5qBJzzs9MC7736UkGSDDniUJJG8/LFF//kmGmoAZAGLo2j5/wd2UrxMJK+iqKhTkS3ArgAxrZOOOiXrbnhbWMkLHQnbYuWlMClYZxYU6SDxpopRo5r292AV1KIZBZV4APBuUHcKSIr2MWMI0O1MKIP2IpKLE2TS5wLmpQodXZhP6M/UPrO1sZzkDbgjYlAG3g8l65nVd0/CBUxKQ7KDJYrtX0vSmnFXg/ykfgtJNiwqfCnqbr85+Bit7FwkUrBseKh/2U2Q+suGo1YaVrSBnXtrhGHEdsb8ycE4oG4b6a1Y8ZyGoyp2Q2iuJRzTRoqGlPQJIAJpJFswNcoAhPJnK0+Ce5dALefhGEwg7NrKg3sxA1KwA7/Zi/pABFI3vPLOOar1w4ZJ3RPRgGKcTnT1lPgcX8bmQvf3SygQSZnxLJ6lsKw43IMVYfpajeyfEEcPsAgPy9N3X8IQ3zC3qZcEuPtMkisBZ9MPJGmHt4OJb+RRYcPqYktV/LuurOUzA==
---END PC DATA---
URLs
http://gandcrabmfe6mnef.onion/d22a53b8f5ab3a2b
Extracted
Path
C:\DOVZNRFX-DECRYPT.txt
Ransom Note
---= GANDCRAB V5.0.4 =---
***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************
*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****
Attention!
All your files, documents, photos, databases and other important files are encrypted and have the extension: .DOVZNRFX
The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files.
The server with your key is in a closed network TOR. You can get there by the following ways:
----------------------------------------------------------------------------------------
| 0. Download Tor browser - https://www.torproject.org/
| 1. Install Tor browser
| 2. Open Tor Browser
| 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/94a62e0896f6bc62
| 4. Follow the instructions on this page
----------------------------------------------------------------------------------------
On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.
ATTENTION!
IN ORDER TO PREVENT DATA DAMAGE:
* DO NOT MODIFY ENCRYPTED FILES
* DO NOT CHANGE DATA BELOW
---BEGIN GANDCRAB KEY---
lAQAAD1QkUXV93wg2KlgORapIWMDG1Puwk2TCk7lS7KbrgNLgl7pTVVuV0SzgwCh8wti1IyI8qf2RvIzj4mQqzobZRMN00DZ/N6JBJYT10qAf7Bw7P8vG9KNQhHWlxmJ+3Zu752wz73bkta95+RVC7Ytvl+VF3tbCBkTEPc+unYA+uBI56YNwnMtOLdEKmy6IRYMfDZpd5TrNk6cebOIv1izE9joLOwo5EmtMyLOop6w1vu+T9ECMnrsmb8n0CXQHdfjXqsvAMWgPjkeuqksKyJjRRdfIC0U1nU8H1Vtf5MKe0YcX2HEN8UrBRXIzENqDO0+9+Uo3Yw3YlOH5JBBNBLz1mi4/KutWQ1roF8UKXkZqPPhr0U28klx+KO3u9l952SMSekA/RIWk/bKrwVI1G4Yqn2FWBifVRejBc9hT+WFgKnDxlAZuowPgAC01kJH1U7rohSGTJ1oiV6TayIK095ycj7s2/eT21Zc2dnZPCDP/jrEiZ+gRrNl43IJGsww5v7th3fciT1u7IjrR+33sf6K95r895DMAzAb/A3O7yEGXp5srNbjy0NII+5gi7h+o4euknXMkWWtutbqK3RTRu3teXyisS0d1JgB0LtGZkAgnyWwB4DkqEYCSyTkmGGMRO8Hw06q0DJK6RZBoryi/EWKWQuBHQp/2BAzGCJS50Rd6LoR5i6JO/GOy9VVPBHMw8hUw09XaQmfbBPjcFnmmfrL3187BFQyYxZXhj+aEK4R7v80PX79n64SHPfk2iU8lpipiSmjUWYinYk3BiluXBW4Mdrnd2eq1Bm2Pq5GluyuaD4fAQcFmg2JdIc33+KRaJ226TcSldrNkPELiP3EETtzYxbUZYnTN/vPCIhROmsVI/QgAHMZ53XroKw5DMqakZYzhPGV3vzg5/4rBTAf2irMAglPybRWFl+mCqIP3K3OoFHhyDpC6C6aBc/tlOme+oKjcoqT728t0wT98dtI/F7l6tJIRjB9QokArmiUddcmRmMjDVQwYXyYVXlnpXkoACqEpkDI8uCM7b8YQvIFENyFz9xVDXtHdV7JaDlQoneW9+8ziLV37D/SGV6pJaj2yzZtFgTuBRS2p1TJYBCDKzPy5ker9MyYIybe4Lx286gzkvgNYaexEvHHTTk4OxUVkgepl5C7sIZIoHq+wzD8CsD2nky19ZQ9HnUiT01NZjZMTFWnMCUa9Eyj991RqSsNTpj8cEdwQL+MlehGiDRk2gaUXLgzM3WlNNryAMMmj1a2Z9GcZ0nq8pzTGjf38G2dSmHOS63utD/wio933rRWcx/lNAWB4y0ixcl86Nv+vc1RMAOuqx29uyhxBzqInW9rCl4KFdYglQSXSgVQQQlJSgmQKE3+jyA0Q7Xmo2wv3JrfvJoiEmhxDw5Trb3UVZEQQ5UJv3K6SR/xfhpSnxK5it0GAa6wHejlfgMy8jSPa7QDhxqgJpChM4/ZhOP4P5polc1Q91K5XeMJYGcwGRxNZyUlKOXhWzKAQy5nYdZF7n67JHy/dRUowYfTzx6RSMvjpPpuDzZ+Xg79lNpJxPt8YJr0EFrjZc8r380vXw2fI+HF/8bIiCUgfPT9EOl6ugNW8mOZswE4uVbPRyLLeJstG+TZBIS532ckniuGwwIRXwmVIvUJzyKepzMRv2rV6q6FzG9rq2DhdoTLrfOSSwYs327Z3BOVwfUIyoiR57BWp2YVnGw1gETbc9VrcqPs/6wTuoBG8nj5XQagNv7o9/60fxBjW5pCvyNnF9DzsXaaLFweIJHscDOjSKnJiSiY6IVORhlq5vmY9GXbQhWfGIumHy6RmmBq6mpsq53z9DQD3kG+p3rzgsY878mMRPJFRMhB1AILnZxGvzDkd1qlG6PnMD4LNNeeUxsxgQrg2ZFQjcUHHsBUyZlLEG6vYqMr6Erx6YjbJHy9cN0v7zLYWYfioYTocOpQnW+xtKMCYNuUppv91PgAVSQhSxiimfTkfVonCI3rJ5Ghy1xiSVFt/nkoKfJgPU+8hEZylMcfXqk5fPHi3bWQwPL0m8tGtNP+POSJLwRb1iJv4Dyl2Sb4F6fG34Eu77WcH13Pmw2nldn9KKqGDT4DQ6Mf2/qYqrPwnHoGW75vt3Diu4AdeTB1dooJ7MB4Zlc2IXsnwq6mGYzoq8VCK/vkPFMNejyjp4D3WT6+rnP0tR+Ekind6xSZgbu1yt7ceOmcxzRu88VcWXB3i85CdCsbV8e9MMhqUbcf8D9wENuzWG/2Pd0=
---END GANDCRAB KEY---
---BEGIN PC DATA---
wfKD6iudumBkmpL8IRr4U4exEVaoOXLtwDwmOrT1y1YWvOiWMx5GYaRdvZZdToFRtHYX7m1WsrfPTHGHhh5qBJzzs9MC7736UkGSDDniUJJG8/LFF//kmGmoAZAGLo2j5/wd2UrxMJK+iqKhTkS3ArgAxrZOOOiXrbnhbWMkLHQnbYuWlMClYZxYU6SDxpopRo5r292AV1KIZBZV4APBuUHcKSIr2MWMI0O1MKIP2IpKLE2TS5wNmoQoAHZIP7k/TfrG1tVzlDb3jcZAB3gql9dnWN0lCD4xdg7bDNQrvH1xSi3FCw+6kfktKtizqdynr7r154JiurEmkUXB6eKg/zc2F+skGo5YbFqLBi7tqxGAEd8b8ydB4t+4Oab3Y5NyPYz32XaispQRTRkqF1PXJPcJ15EHwNAoAxPMnKo+DO5eAL2fjmE0g6RrIQ3vxBFKwg7yZizpCRFF3vPLNeap1wIZN3QWRl2KajmI1gXgeX8PmUrfnSzkQQpn2LJ8lqCwsnJaVYPpdDf2fB0casAlPyNNwH8VQyjChKYcEu7tKUi2BYlMc5HxHowOLb+dRZ0P/YkhV/3u67ObzJf9ZHZZhw==
---END PC DATA---
URLs
http://gandcrabmfe6mnef.onion/94a62e0896f6bc62
Targets
-
-
Target
356bff6966ca7136a8486089c17205ba4b50fcc7f60655d82103dedce4473e55
-
Size
411KB
-
MD5
5809199a0df6e392aeb2cdc1b519be5d
-
SHA1
cf3460700ab3a10a15b1faad3bbbf413a312ae92
-
SHA256
356bff6966ca7136a8486089c17205ba4b50fcc7f60655d82103dedce4473e55
-
SHA512
9de122e2b29db1ff3a348a4fe07e22b3e6c1b0bad0c3f85776f3e6816d486887d1d4747472e16df524c4e9de2679659b841884f1ef517eb14af05894eb378099
Score10/10-
GandCrab Payload
-
Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
-
suricata: ET MALWARE [eSentire] Win32/GandCrab v4/5 Ransomware CnC Activity
suricata: ET MALWARE [eSentire] Win32/GandCrab v4/5 Ransomware CnC Activity
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry
-