General
-
Target
3e817394e2cd062fa1ef3bacae66dc5eb1f349d4d2f2188466a8d0b65186bf07
-
Size
389KB
-
Sample
220701-hys2asaha3
-
MD5
30e1b9e1425abcd750c7f2cb1d98a0b1
-
SHA1
57cabc163e0869d9f266c70328d2f73cb1ccb2e0
-
SHA256
3e817394e2cd062fa1ef3bacae66dc5eb1f349d4d2f2188466a8d0b65186bf07
-
SHA512
263241f42340ae23bda84d577703995eb944cb86ff8c389d5830b09d888af087fa9afa2783ca2954c553f53b7946a0c46ad3ce827e94906f9433398fb85cae07
Score
10/10
Malware Config
Extracted
Path
C:\MHTHI-DECRYPT.txt
Ransom Note
---= GANDCRAB V5.0 =---
Attention!
All your files, documents, photos, databases and other important files are encrypted and have the extension: .MHTHI
The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files.
The server with your key is in a closed network TOR. You can get there by the following ways:
----------------------------------------------------------------------------------------
| 0. Download Tor browser - https://www.torproject.org/
| 1. Install Tor browser
| 2. Open Tor Browser
| 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/6ddd5df25904e315
| 4. Follow the instructions on this page
----------------------------------------------------------------------------------------
On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.
ATTENTION!
IN ORDER TO PREVENT DATA DAMAGE:
* DO NOT MODIFY ENCRYPTED FILES
* DO NOT CHANGE DATA BELOW
---BEGIN GANDCRAB KEY---
lAQAAD6Np+lUAldpN1q4kTS3o1nySGWbGM7I4N52UUal1pD4bylGnNe12m1F9AymAT5JMdTfahm4/T7lM0fbRbPCQFuwamwLrakZ2R2+8OMKGNZzx5mGXfmoMfCX4oMYv5hqvKxpVrpW3+LKhrtNKwlihQjjoq5qCs45X/XV5LQVzx63hfnkLMAnzuqXirA/P/46gym8qhA8+RVHyvRr/LSkBFnNk5NMAGe/CFiVcN9bXEYMhv1ZZkmHqI4SuZERX096gh+3opfZTVZJm+zfroauWQT8uwSs+Lxs2BtKI9ybLHEENx1EGxLr8P1oVjJQFv6iqvAc4K/JJems30l9RJgEHr8I2aMHjS49MWjihoDZjLQe+HJT9u/+iQx7tBm1Dht69So3Qe5dFRnfO5QEkTCA/oc6qmKg3Q4vaOFLdnXSOIno1O4UvsdwCRiBfz+WfA2NJ3V6gX1rqWfucTiuK33bcMAQEPefO+jWZ3TJUWq3fw9dUrrOi/XZvYGRtG4o162+cFaCXLQW5aYS8lbNQRwF9D+F8l5v4UAxG43PXG54t3C3eoVQKGwFNfNz1ISi9PodHxZwLO8jGqYmOPPgIXWN8CbVVgOQZxxVWLwtZLDuax67a+A3QfTB33y0Dr4NvpsJ09s2xdSJJNZcykTz+6R2rAu0p9M8GPKWUdQy4d/2Dd0NJEYj6AJrw8jjMyxC4MEx4ySOqnws+3C+vykeiLAXTh/Ai/y37Zpda7JHlZDL3dtradV8THwtRY1129Bp+EHP9/hmGKscxVsjDxkWLjhb1rhd9b05QjKF5KlnKDmL1+0sK3tPMXnOQ7zmnAf+xTeoonwsF3Zigan0IU2DpXRTKM9crmskhe7mj0+/4Wlfi6nhXcKHEAo8m9q+nIxhcxLf1TonXPOe6MCAUTx6s+Ts1CtOqjj/lPuL9HhRChdg2xxvnbwSKFPnAMEXOs1LT0psAN22SRc59h8+fFqFAx5m+xVMT51+ggqAlAoaJ7IL9YaQ9/k8boJl5CWIQ+GVyEVUqvZWh0Y1hOGTzwkb5gKHT070HSIlqlf74Q02CUmoNEBfc31xPZo9z6245yuZAWBMZhRc+/X9LOQmyqb+gmc+CbvMnKgWBfjOSdE77fmxD49yKDGSHqgnuBtfYDyEAAvEMQX1XCy7b0lRhFdGDuu3TyE4GYmIeHS5gT9zRMje6zu+viKNmbW6UjbjFycVbqC7Y5i0x0jkLSLVRQwviOOwMOuK+au28sX0RO9uUjhn3UdlPe3j3LZ5x6IFWnCxK+02zSDtGyqaSR4fQDtGIqa2WKaIqvOMKrlHyL+USqV/0aKuJZKAlYKJKw0lQPf2wtCU4O9svGW9HvxxDvVV18z2fAs8ZQQKrR4xa7uiYjf535Lh0cFk5EKgpcNnwOzBcV25q5ob5L1IS/RPKeCy5yqpRuFVOqUUC9svc3esFtuslYt7rxyPRPw7Z2STiyR+rpqsYH9McLyLHV8xjhAddPmpW+IljfgS+Nc3dHgA1xLHswzYNx2Y6jIqAxwJrwjPD/zIHCV1Y8lZETqSd5klmj684WiBvQCt6XEu3oisP81B0SSob5FSfo9wQUJCMhXOx80YiAjBvxWHAwYHqg0LqxejWNwsBLcMr0a6yU/jO2u624MvJQf+93cfu5bRcNvwZP4b/H9It7/9H5Xfhj126gsAYcpCpf0zWsXPCpbrcnatr1yf0LD+z8ITTCsgJAfAmJsGkbzF+4rsKnu38HWbzL6Q5uB4aRv5GgSwJwoS5SDwBYcE6eYu0ic6HhMkJmTCKiYTc/4kU1RpFPoAywD2IPa5P54pfwcqVEriTPIngVzXDuFN/2fX2fG23dfWJDOVnf4YMG3MehmkEUJX67L8rgzimiAUmwqOt0aBLjPdEYB9qEHhi2P+sTKOtMk0jEt9oaUjwWW1NCw9SqvcNm5LYmb+pjIpkBhqfjf/jllin4q8ep65U+wJDV858ga/jVqT3NEVW4DDsrTSCYNIp9EkkAOjptW9Z3I+5ehngc/aTuedW1Is5li2/lx9bQk3jRcCxYd+HkEC1tIpPvguFtsCQPmtdL1kDUJEdEBLytqMjrm+dJycJpyKRh/rxi+TpUrlJP/msRRYBjVH4v+c2lgaNmIwQrxJTNs02f+WvKHve9/yoejBrKtzQwXecNerRDnOe4PTidGRls1AKs3fpUrlbUmGnKS+KyTEXG6EunmIcpSSG/7Nf5u9aOXEA+ubxIjNke+Yd78Ri+0=
---END GANDCRAB KEY---
---BEGIN PC DATA---
wfKD6iudumBkmpL8IRr4U4exEVaoOXLtwDwmOrT1y1YWvOiWMx5GYaRdvZZDTpVRtnYR7n1Wp7fGTGSHhh5qBJzzs9MC7736UkGSDDniUJJG8/LFF//kmGmoAZAGLo2j5/wd2UrxMJK+iqKhTkS3ArgAxrZOOOiXrbnhbWMkLHQnbYuWlMClYZxYU6SDxpopRo5r292AV1KIZBZV4APBuUHcKSIr2MWMI0O1MKIP2IpKLE2TS5wLmpQodXZhP6M/UPrO1sZzkDbgjYlAG3g8l65nVd0/CBUxKQ7KDJYrtX0vSmnFXg/ykfgtJNiwqfCnqbr85+Bi5bEmkRzBtOKh/zI2R+skGt5YZVqDBiPt+BHVEdgbpCcE4oG4b6a1Y8ZyGoyp2Q2iuJRzTRoqGlPQJIAJpJFswNcoAhPJnK0+Ce5dALefhGEwg7NrKg3sxA1KwA7wZibpDRFI3vbLN+ag1wAZJ3RPRgGKcTnQ1lHgfX8bmQvf3SygQSZnxLJ6lsKw7XIOVYbpajeyfEEcPsAgPy9N3X8IQ3zC3qZcEuPtOkj5BdpMKZGsHsUOIr/DRYoP9YkiV//u
---END PC DATA---
URLs
http://gandcrabmfe6mnef.onion/6ddd5df25904e315
Extracted
Path
C:\ZDMAA-DECRYPT.txt
Ransom Note
---= GANDCRAB V5.0 =---
Attention!
All your files, documents, photos, databases and other important files are encrypted and have the extension: .ZDMAA
The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files.
The server with your key is in a closed network TOR. You can get there by the following ways:
----------------------------------------------------------------------------------------
| 0. Download Tor browser - https://www.torproject.org/
| 1. Install Tor browser
| 2. Open Tor Browser
| 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/2af0fd01569e138e
| 4. Follow the instructions on this page
----------------------------------------------------------------------------------------
On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.
ATTENTION!
IN ORDER TO PREVENT DATA DAMAGE:
* DO NOT MODIFY ENCRYPTED FILES
* DO NOT CHANGE DATA BELOW
---BEGIN GANDCRAB KEY---
lAQAAK2JyU2OFDDKSl4Q6JMzH0GQ+LQ6jgxbTzhahvMGjvpM+1ctqpfCd87eYuIhmiuR1/tlrRK4bSYOvc0cwexKZtVSBXOBcQ3SZXTg7kVFvQw2e7wxqX0IYghcygrKl/nAs8ubgJmZME0zoZTZUxMPJVf0aWDyr92a562YI+BzdW0E/U8lSLXAJZgNDwSR9jC6SaTgQKxp69q5HP1KRRn2ixG8m+4rJ7goZcxtp0N58uhORrkugKa/2UrUnQ6p07NKjtnFUjTo+kogber3XkXryyoaOVi1v2ZBksGCyixxJ+9lhCsMPf3Csp900gaAXlT73itFk4k4FG2vqL/FbELB4RTOuMVfmiIPHy7vZ2NnqBmp3QOaGKRWuU7TWvmMI15tgEGtSKXAD/5FHV4CpZ3O/fc4dogVO7BKZ4G+S30WnvfTo/g0TasAG7A4mRqHNT1nIwImqHivQpSYY75H76nGjaTqwmzib+mpQJcSB6qv3o5wKThKKNuCf+1MIsUiJK5bBvw5Qk6qLXm5XBF7OZ0Mn56Mofn4rLyveWWQuKl7vtvR/tFjGIn2zuyhADR14PibpCMh3kcVusLXgSeJ4W7oINrDxwqo6gU1vXF9RSKj1Ai+wcHODY2mXA8DPWyz2vV2fIG5hETkbcUn8byceFLr0VxiyCLqdPa7f0X+mYY3qWm+B0JNY8yEOUhcRNLnUjpXjUEN8O7A4u4uI9IjC18UeS7bCknjMCT+vh5IwR+ZTP7uOQCKQxDmDSQ+7oWefPgbVKDf4/BjanK9vpHDEJvWqMtpYMRswiIQtcyT1Cx4c0wOdpnWaC8WS3xgkksLM6DnP9HVd2lV9atnVvPjjljzt6FUlzkS5icrUVWUfIgORUBWTR0bIhfrzNn6yn+T2PHxd3ydXHGwzq1OsRmBFwxeV/Z2swJOEdfJ9YXLjeZi4CdIx6zFDEKJ+lriQbz2v1OJ+OEOX20zk6EL5Z9qiXuWjNuVz0DqmQSOjxmkT2UVAo+BrO9hJsGMlrItkrMSgy61ogWNrFJHsRJaRtYNj7q79t+cvPN3iBxf1CC+FLUKg5lWXUTNr1HtQI801Q/m861MXoX5xCdPAiwr9IoPbRjKudeDxQpaBrbeTkiyiPH4AysGYx4ZOSsc+iv6G2EcxU2dzIZ/JghxI806kcKb7vNRmcXE8rOtb9uE2TFomfC4oe0iKVj0LB3Zp34nO2d16o+V6zJpbJTdn8uQD2lcAsIe+mNlU6xgSQTQfIrnLlByZ1PRcH94RzI2J5b/Gk1pGFeETCc8KS/8Pn35Y1TYZsmbHftRd9Z/gywldsFmGp1sKyAYghCDSEfPXInVzP1+4s11AzRCjnduMdGSQ5bp0Eli1CH/tJDLislL0979I/1lrPtcachSGCIynS0HarjRH8HV9ISiSbeQg4X37U50mPpaNQ5g/bpf/6XgjIgBfGJly5mV5jUAgqpDCIeh7O3s+qOIBT1rcaWs7OeFg5wqDU+UMjeSbgy9DSGXUmxOHb89KBHTU+/90tSeihy+d7qiQW1K4yDbKPMP9XaR+efk9gOflF1mTzmNKuWkFX1wUcV79DA0arXizpX0Lmvxyn6Am5lh6ian+5l8wUXB5qjT2cX9rfUMHIZ/0YEr/mBB+6yt8jeGuqShc3gBMhegRTLL/muFcMOPiQ2TYzDi3hQIX/GoOYB6bxESkDAvFmn4e81kbYLy0JjIEPbxjCSxhC1FM70+6AsvFSsw86ld7wlgcUv7YdBPAueh+xC7yqDQ9MC/3PUWJNFZyslnwhSbI2yNyx5GbUvxb23VU6N+Si8xlrMb1KgvbAgQqqWEL4qW8EVaYzOIid6uQ6CKLwKbGja/I8kb8ZQm6u7lOUCoh32nfYnEf04NXUOFdAI5d9r7S01Twh3ALb0IfANwjAqDNUuwqvWhFYCR18Zaa7/uMBHMe8Lji5urn6FhyO5afIsbXYF957FKzEwKv7cCQJA5vjZ3KrewA/rAC0OYuwkMgzGFJPLrE8qbFmsK0cnvZr4FxPIWTVBYxYs22M4yEwY4lC9YVT0qTvuu1thZiNmVx2T4AgZPfWIvqnyFrBEOU4xCGp4VI9Hhya1iVjPflQv/pr3smHls+0/mzAXwxUIzUn4vMKJCLKXjtzB1P/HMbVdEedtwjNrsavKiFSQC8Uf7MppJ3goZDINJdriiC7f6gK860Mn0vxrg2xm57W1l2YKwoLNlNg6BQ+Y+Y/oKYonDGKakfUke4pI2l7o=
---END GANDCRAB KEY---
---BEGIN PC DATA---
wfKD6iudumBkmpL8IRr4U4exEVaoOXLtwDwmOrT1y1YWvOiWMx5GYaRdvZZdToFRtHYX7m1WsrfPTHGHhh5qBJzzs9MC7736UkGSDDniUJJG8/LFF//kmGmoAZAGLo2j5/wd2UrxMJK+iqKhTkS3ArgAxrZOOOiXrbnhbWMkLHQnbYuWlMClYZxYU6SDxpopRo5r292AV1KIZBZV4APBuUHcKSIr2MWMI0O1MKIP2IpKLE2TS5wNmoQoAHZIP7k/TfrG1tVzlDb3jcZAB3gql9dnWN0lCD4xdg7bDNQrvH1xSi3FCw+6kfktKtizqdynr7r154JiurEmkUXB4uL1/zA2EetwGo9YbFqCBiLtqxHfEYwboCcR4tG4bqb3Y5NyPYz32XaispQRTRkqF1PXJPcJ15EHwNAoAxPMnKo+DO5eAL2fjmE0g6RrIQ3vxBFKwg7yZizpCRFF3vPLOeah1wEZOHQVRlOKajmI1gXgeX8MmUjfkSzkQQpn2LJ8lqCwsnJaVYPpejf0fBwcasAlPyNNwH8VQyjChKYcEu7tKUi2BYlMe5GkHskOOL+XRYYP+olzV/Dut7OUzJr9
---END PC DATA---
URLs
http://gandcrabmfe6mnef.onion/2af0fd01569e138e
Targets
-
-
Target
3e817394e2cd062fa1ef3bacae66dc5eb1f349d4d2f2188466a8d0b65186bf07
-
Size
389KB
-
MD5
30e1b9e1425abcd750c7f2cb1d98a0b1
-
SHA1
57cabc163e0869d9f266c70328d2f73cb1ccb2e0
-
SHA256
3e817394e2cd062fa1ef3bacae66dc5eb1f349d4d2f2188466a8d0b65186bf07
-
SHA512
263241f42340ae23bda84d577703995eb944cb86ff8c389d5830b09d888af087fa9afa2783ca2954c553f53b7946a0c46ad3ce827e94906f9433398fb85cae07
Score10/10-
GandCrab Payload
-
Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
-
suricata: ET MALWARE [eSentire] Win32/GandCrab v4/5 Ransomware CnC Activity
suricata: ET MALWARE [eSentire] Win32/GandCrab v4/5 Ransomware CnC Activity
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry
-
Suspicious use of SetThreadContext
-