General
-
Target
3e71e188e91521dfe6b679264592598593a662fc1e3ef3ec0d9718831455a750
-
Size
586KB
-
Sample
220701-h85g3sbdc8
-
MD5
6be55222abd92fa15e0842014bb13116
-
SHA1
00dff6871b36c36828b5e2fcd1e3ac6a886025ad
-
SHA256
3e71e188e91521dfe6b679264592598593a662fc1e3ef3ec0d9718831455a750
-
SHA512
827bcdd8302c88b13c67fc6f5a9fef9487c36e72b56597f770705fc1149643f82396b45544542851b733ee11fd15ab9f6f276a4be36a48cdc5c7436ac47cf2c9
Score
10/10
Malware Config
Extracted
Path
C:\EDHHNDIG-DECRYPT.txt
Ransom Note
---= GANDCRAB V5.0.4 =---
***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************
*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****
Attention!
All your files, documents, photos, databases and other important files are encrypted and have the extension: .EDHHNDIG
The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files.
The server with your key is in a closed network TOR. You can get there by the following ways:
----------------------------------------------------------------------------------------
| 0. Download Tor browser - https://www.torproject.org/
| 1. Install Tor browser
| 2. Open Tor Browser
| 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/14694067130573e6
| 4. Follow the instructions on this page
----------------------------------------------------------------------------------------
On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.
ATTENTION!
IN ORDER TO PREVENT DATA DAMAGE:
* DO NOT MODIFY ENCRYPTED FILES
* DO NOT CHANGE DATA BELOW
---BEGIN GANDCRAB KEY---
lAQAAKxr62dD6TvQQAm85QdHdMMKk1uGxOwNHb90RJNy2XM1k3336qGJXji7gK5a9/ngGPWBBHnVJ/xqsDkvNDRkANV6V2z7Yzqors1DflUQrJmJE8gCn+vInVOQtXnNRmeaMKANE44k/3egFcfl7fNyGWxgfWXtz50yRXbnsN0+rhBsg2LEsUhhoWxPW3pXBU5lLWDMhTO5sFrgKuoSIw8tvhxiiSmE1unuSEsTxG1ZMDHBNpIpIfKfAeFqQz9PnG7BjchU0YbklAW44yMQYLzkNzcrP2qT6+5o0yjBlucHOKqDoSjzRvv56UPquugAcG0JEkqpd2oDB4LgaGosrhPGSXd+FmQAdUhmLDIgJrHHP6A0LTZb1buVNCDBi0vMK0/fJiF03CBlyBy90U+bJBBFFGxqP/xr1agK6BvpZOa0t0AWLeodaRdgY1DO8qDcM9BX28CzjKfy50K8ux4IfM13xnZZ6ImslDJ93we3X5EwTGvpxHKyieTATH4amdewPkrk6O4Wd3b3USimFqLsc3HXkCU6foTskbmaryaqfXfZ6dbrbAuGCadoCh3i2f+nsXZR8d1uzWeNVOzCUrVCfyHxYSriWMghMnYpDxxmRfJ7FyCyHywxB8w0pRCoQdxNLL7QzGjqKF7ZOuHC8fsHF3OWQ4qqmfUqsKQLTZIT5IMBHe9r9bs5gr2lYhfwYNLF1s3yfqUbBomA0GOSUSaRM14T3EU1Q3cb5/Yh9oDwddIXI5Uk8yb6LLyXoGhIyyMnq8BJe8vepRBk2UstJCQY/+NMGl/EZBFaTQ9dNXoxyJEgMqtcKXSmnZw3W3U0VU8kzr7I0nt24dhw7htE+NUmidCv0RhAE7NnxQyknJ/6m2xO75yNIajsiqZu0fvJJdHH0j5XFScz9U2kSVfnd2TTYOxqsOIEGgIwmdd0tLsE3oihRIk5WGA9x+k8Dy3vrSzqEKtUJnqQeyKZGI/lMUnxb1JcYpZh1fnBD0GlsXtRmSfKoIlWBNLCl16HhmCw8m/3aGNRoaaxutsokpEAGy5eOcraZtvaYRUC23j/2/hxvJk2s6U5nvEQKz2FQTl5L1d+JlRQb0/9NkyXWyqnHrl0xQZhj4kSqWn3ffUvxV6GzWj+HfPQ35piOsHjNFLT3jdYb2fWVuo0oU/m6Vio+QJ2LtRjg/1imCeMJGy5lVfQ9boxMDallYFIg/rp8wreP8GyiJr9MgMoLe56mqg4Xmg8oH+58Tg7uMoL9tDSUTHIQ7QwJgOdeRo47NrkWwqvNPZIxo9o2Phpa7tgJX/xu9kWzhBrvpBRUH6IyrPKr/3elIfhqvKSDEn/2VZI28nKCUdVvZa5TMCZs+pp7m9Tj2JNY6XutfDgec6FYWxz0GYgOJ0te2ObpvEV44cvbzjwXOEaxnAOal9w25bZ8qbEU5Xu0tTQPEX8L9wUHMWUUiz+ucSINqUzYDVmPOh7Q9l4DaCejJ4LcM16CHzd487AjW7I3cvScz0BSSMHcfuslJpir4RkVyGZdD5z1BWYSMdhrkhZRk69oUQPJ/aq38kSt9BnRaxX8ThxK3/of/VFJgv0AhcOMsPexEsM1NzjhLWusffMPLl+fFuTU3V+U5u5/LnIgDRYN7jA05HZHoV2Q5lDrH93sgNzX8Du9KRd1oJZeiI3+jWbKTpF/m757V9E4XnUnhu6ZL4iNwqppk3Uw8NYo9vi364oAUHFu4aHmGAt3bshxza39oJ0r//CHQJEt8UcnHZqbh7BS7ConQDzMohZEgi7fi5Qr6UnLGoaVBRzp9/51V/4Yc4JE3qamPbjckQNTal9jwUkXfn9IXRcTUPxoEwyqdTGtepvw+lsH07lvtQDoGoyu5UCDuo/wiNcOsBwnH36RBzqahbHZWC+wClhYFBm6g7ceDuEVeF5SmHUOwVRNTFGC5wQvCwaF6poho4SynHHC8AU3WSmRfNhNmOc1d/cpFIXOSk/+qUXaKWxiy8QwyOQ7xhpnmkhFPwKSn+MrmUFYm8cveN34YS6BKNMttOZXok9wlEdiXYpoa64jTKULcQerD0DavAN7b1X0WusoYcWGmosWi0snIhCUNB7sAPP+OINYRi28RsMAaalwfa95rJhJyonfibzMEVnVq5qbxcdxkqOdayNdlU9dtxMjOD60k+f8lI17NCF6iyP+LINbgK1jcn3dskef29Kh9QKyMnoKzD68iObh72JFmOVD6VBRIT2/fB/Yj5QA6ZIMQidnJO7OcAxKsM=
---END GANDCRAB KEY---
---BEGIN PC DATA---
wfKD6iudumBkmpL8IRr4U4exEVaoOXLtwDwmOrT1y1YWvOiWMx5GYaRdvZZATo5RpHYM7n9WobfCTHKHhh5qBJzzs9MC7736UkGSDDniUJJG8/LFF//kmGmoAZAGLo2j5/wd2UrxMJK+iqKhTkS3ArgAxrZOOOiXrbnhbWMkLHQnbYuWlMClYZxYU6SDxpopRo5r292AV1KIZBZV4APBuUHcKSIr2MWMI0O1MKIP2IpKLE2TS5wLmpQodXZhP6M/UPrO1sZzkDbgjYlAG3g8l65nVd0/CBUxKQ7KDJYrtX0vSmnFXg/ykfgtJNiwqfCnqbr85+Bi4rF2kU7B6eKg/2Y2F+shGtpYb1qDBiLtqhHVEYwbpycE4oG4b6a1Y8ZyGoyp2Q2iuJRzTRoqGlPQJIAJpJFswNcoAhPJnK0+Ce5dALefhGEwg7NrKg3sxA1KwA7/Zi7pCRFL3vLLNOar1wYZJ3RPRgGKcTnQ1ljgcH8bmQvf3SygQSZnxLJ6lsKw7HIOVYrpajeyfEEcPsAgPy9N3X8IQ3zC3qZcEuPtMkisBZ9MPJGmHt4OJb+RRYcPqYktV/LuurOUzA==
---END PC DATA---
URLs
http://gandcrabmfe6mnef.onion/14694067130573e6
Extracted
Path
C:\BAUTLLWVT-DECRYPT.txt
Ransom Note
---= GANDCRAB V5.0.4 =---
***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************
*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****
Attention!
All your files, documents, photos, databases and other important files are encrypted and have the extension: .BAUTLLWVT
The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files.
The server with your key is in a closed network TOR. You can get there by the following ways:
----------------------------------------------------------------------------------------
| 0. Download Tor browser - https://www.torproject.org/
| 1. Install Tor browser
| 2. Open Tor Browser
| 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/78a235bbd87537f9
| 4. Follow the instructions on this page
----------------------------------------------------------------------------------------
On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.
ATTENTION!
IN ORDER TO PREVENT DATA DAMAGE:
* DO NOT MODIFY ENCRYPTED FILES
* DO NOT CHANGE DATA BELOW
---BEGIN GANDCRAB KEY---
lAQAAEmpBiNyiGGh8f9GWFOhRr7EkjMbH0D4pb5jFmx2JsnVxrF2Aco0akDJPcYEQUC27jAtaePdlpDAf1rZ5eFlgilp/2yzeZ4s3fbDQT21q0Q98GaKLEtCqM8TUv8E4VVmEDCKzSj36dOaDAvw4MrzKUVsTv7wFSOL7FpHiyzcApSn34qCYV7ANY9ndKcsrUTg3vdhFS7AFOLl+B4LQznppltE6h+xmXw3QStSusdSnGNUCiW/yHUwPX1UowROa9scJfd3gkA7dOk6PFTSR3L/N7SeEKlpYK/vyCTev1Fj1zBgpKm2ZxskvW0ten4RSwUKP1F+XxLpwuw2WD8DTUPLnniqEV5VRPggfH2WxE9Y5HdS/XeIG9TfZIFxHCHUJY7id0CRtLglJ5WuLl2Deh6/fCnnlH7W3lVD+xI8LsbWVr7UYOt8fAKB2hC1CABtMI//KZgqTaL4e/My3TbPEnwug1SEYA33fhTBKGUB5vhDU7ADUtI3KpPJtke1r3FcdbWlk9TmOtnxvTmimV45Utg9+0iq4TN6mrDCVV6DqhDXCq8hN4Gqe/LN0/fnJee6Ai4ksWI5tCZ4H6UHichix/RXFL95T2um6DQiK2HOO+b3KM3V0u7Z9oM/Q/yKkx3bDqfTLBDPEMJLzI+FIhqZuaQHPgx0ujc8+W4z0zwkitB6h4ZNcIwc4JUXhGjajh0DG2VOZW6yK0QG1obYEGJENP+jF3bFve4Bi9SZ0etd6TJh/psRS/l7I+9M+l7ykl945AJyOYepQcQ6rstnlNT8bJ3+dpaPShv+P77KLH6F9tgzsDbUikimWJ/GcoJUNlMldY/KeA8/UDt+bmolaefe1XaWAAP9Dl4DuzdWrwQj19VluVWCoWXEC/AgYbIgqG+x8qbJP7aynegRm0lEhJLuXuj7Bzz1O+1z74uw5CW9mVQzFERjrf5eks81fZ38P+p03Vd+X/GEUqZC9GCShp9NA8O6hKCYEOwuAK2QQPh5wLZoVSYaTsOdZyqVplDQhOjDaVM1NIyOk8p15UJLosFwmixe4crxpT3DPxm70khy8qwwgme4AovyROdkCD6DvxNca0NZnThC13E5uPMgyNIik3IFOF1lNdEeE+i2QCG/dMqsxPCmLv0tj9L4vjZLh0NNTtqyIqsA/AxofzDjLEfFq22YD/Wve4q27HTLHpHOl2QcNmHHvL8+vAsJkwb5f7CMbqDsZZpe4yqaxI6r/cBWQ6b1pupaal8Nl/shJF1Gj1jrf0mBtjt/zrosElZZ9RDN3o9pKLJQOHi8w/NsoN+hSYcxSNxvshOZwWS9NWc7BIGBEiP4iltUHFjXTdXQZTRG6rNs9nm9I8wRY9ceySSOOtxbA5Tffee6a/O+RUxCvlL6iAh5XacP6r0rpM7fnAXBOs9iBwl9WsazpU6LVQyelJazVQnIqYmJ5wtEZiM2XKnGsW5CTISAOehFtpIB8PnfVSqTgpcHvc5TyjdYtpvlHDq/RxtUvCcrITVS+792anBYgcxp7OSXYMqaiTOFOoJjfvjVSqyM8CiWAb7f2o+EYHjudr3Mp5cuII3bisl5Z+/wf15UkjXmSnLJMAJNx6RD2TQfI/O3HDiMfT/pLF0T7tFsddcdNkPWhXAglr0qeuYuCccr/pYZEyp8oMk/cxbDaRSpIUhWfQ25VU7Wj9ZzW9CGchim9e/xNh1JZrjbR5UDQYv3pyNrTpBu9oI09Bv8t9/fB7aZCCyGarlFsi3P3o4+cC5PLbJvNIzwj4D+QvNF1zcByrQ/WdUkMtqsqKFqZMEQygaLzvSqp2pFLMbl5Sw5xyr6EgYhmXgDXfMedkA64ycbb1zMYe527dmIgl91x/vuhZ4TeDiyvl3wcKmKr8wyyu7CgEscCcHTP/C0hVaaphe48EtFbjFjPnkB2A2nGrtAVs9UliA7T0/DFlbV/N7AP5jdnIC6xtLNMTcGZXgdaDgVsMPteA0CpnoaPel2JbZRUq2W7jCOEMfoV4MaYyO3mi70rf0MQx22syaU/AGpEpsDMhcrvR3FpZItTs5liQznnpbDEjajR1K1nIM30Qum5wUeWZSUekJoeWrw+r+n8suysdAhTlnfNQwM8SpBomSveZ/ZmT2tf3sg8JTvGMWKPBdz+7/nd470RwZEkGimzO5vGmZMmDmCpa7vmAhDLrKBghiS9sgGUfBvTEf+8XDQcQGpOZbfVrhIbZsyCB96pmRrTWN4BLu/IfEgxlqwdx9IaRxnuek=
---END GANDCRAB KEY---
---BEGIN PC DATA---
wfKD6iudumBkmpL8IRr4U4exEVaoOXLtwDwmOrT1y1YWvOiWMx5GYaRdvZZdToFRtHYX7m1WsrfPTHGHhh5qBJzzs9MC7736UkGSDDniUJJG8/LFF//kmGmoAZAGLo2j5/wd2UrxMJK+iqKhTkS3ArgAxrZOOOiXrbnhbWMkLHQnbYuWlMClYZxYU6SDxpopRo5r292AV1KIZBZV4APBuUHcKSIr2MWMI0O1MKIP2IpKLE2TS5wNmoQoAHZIP7k/TfrG1tVzlDb3jcZAB3gql9dnWN0lCD4xdg7bDNQrvH1xSi3FCw+6kfktKtizqdynr7r154JiurEmkUXB5+Ks/zc2E+slGt5YPlrRBnPtpRHREdwboicV4o+4Mqb3Y5NyPYz32XaispQRTRkqF1PXJPcJ15EHwNAoAxPMnKo+DO5eAL2fjmE0g6RrIQ3vxBFKwg7yZizpCRFF3vPLMuap1wAZMnQWRlGKajmI1gXgeX8MmUHfnCzkQQpn2LJ8lqCwsnJaVYPpezf0fBAcasAlPyNNwH8VQyjChKYcEu7tKUi2BYlMc5HxHowOLb+dRZ0P/YkhV/3u67ObzJf9ZHZZhw==
---END PC DATA---
URLs
http://gandcrabmfe6mnef.onion/78a235bbd87537f9
Targets
-
-
Target
3e71e188e91521dfe6b679264592598593a662fc1e3ef3ec0d9718831455a750
-
Size
586KB
-
MD5
6be55222abd92fa15e0842014bb13116
-
SHA1
00dff6871b36c36828b5e2fcd1e3ac6a886025ad
-
SHA256
3e71e188e91521dfe6b679264592598593a662fc1e3ef3ec0d9718831455a750
-
SHA512
827bcdd8302c88b13c67fc6f5a9fef9487c36e72b56597f770705fc1149643f82396b45544542851b733ee11fd15ab9f6f276a4be36a48cdc5c7436ac47cf2c9
Score10/10-
GandCrab Payload
-
Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
-
suricata: ET MALWARE [eSentire] Win32/GandCrab v4/5 Ransomware CnC Activity
suricata: ET MALWARE [eSentire] Win32/GandCrab v4/5 Ransomware CnC Activity
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry
-
Suspicious use of SetThreadContext
-