Overview

overview

10

Static

static

rechnung918738.pdf.js

windows7_x64

10

rechnung918738.pdf.js

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    43fd4796850703c76c679afbb4760a6f78ebad5b07d0fbb357f2e54dbc1fb5b1

  • Size

    5KB

  • Sample

    220707-zzrnasdhg3

  • MD5

    32f7972a5dc08610ecbecd9b0024eba3

  • SHA1

    087efaede6b348a745a48265d57b339751a04632

  • SHA256

    43fd4796850703c76c679afbb4760a6f78ebad5b07d0fbb357f2e54dbc1fb5b1

  • SHA512

    6fb27c53a5f6b3c221d191ffa77275eb2349deb6bccc9c109f99bafadbf2bd17378becce058397303a623341af6dfce93291caa7f20de9209d08a6a566ab864d

Score
10/10
gandcrabbackdoorransomwarespywarestealersuricata

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://www.sumiyuki.co.jp/js/test.exe?DuVBLp

Extracted

Path

C:\IASNACMA-DECRYPT.txt

Ransom Note
---= GANDCRAB V5.0.4 =--- ***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED*********************** *****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS***** Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .IASNACMA The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. The server with your key is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- | 0. Download Tor browser - https://www.torproject.org/ | 1. Install Tor browser | 2. Open Tor Browser | 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/f1d13815d7a7eeb | 4. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. ATTENTION! IN ORDER TO PREVENT DATA DAMAGE: * DO NOT MODIFY ENCRYPTED FILES * DO NOT CHANGE DATA BELOW ---BEGIN GANDCRAB KEY--- lAQAAMLUMJXOCYqQW+bDEfkjqJgERfIqOvIudzmRmgyWON5How4urQmcsswj6nAX1X+DhEIBLF0JlUN2G9i3KZx2/1gRhsmjFujO+JIlmp4fixZIcjGOddl79aVJl3H+fEJ0cnPXA3l8W1GPceTt+loMQNwM1ph8yi+Iv1eI7RZN2J94YEc5JXafzaCVcxiVY+r+yY8MrmxoWcGlBYjT7d9sAsi6D9CKE8o9Wp5Rh5Ws+JRsa9G8n+zjJhXMbvUV86gYhEfB5p1+xfo2yufe2OqS4PiqZFR3a/OaWE90bm3FE0Sule8kiU96HcNSOArnWcsUq77b7zU5X6+zBkAHz2HDXkjZu50IgoanQgrZjI4VNb5HmCdZL9S7y15hBhfwGVSHQdTtxU5TJFa/9rhtKveT9xFZHEU+qgroz+v75ratDv8KRrmN894ZBDfUzMhPw1StNwQgewC1Glpq1TImFgR2+MJkDubt0tmycuWP3XffjHMS4PyV6cLKvvDK4A4bMyVtWRMaYW8ENVbiwppEjzh/PiVos78OnDbmURWjLKb0zhVasLK47DDtZCHCx7ta68C+5mSw9PKZdHMX/2G6sDvT30dv3I1lhAuU3nutz1qolCDQtWwDnZlArKmt585hM6E6/GCHaEU1wQUuGojZWLPs6DKO2SM7dfmJ83mCy8W2TINkhuJ8oZyPDynRkd8SzyBrD3SfGqvLcA/eRNWEr39scOhDHVCqQlQo/MwTrF+RcDAeRQXYhYlqkR4QnqBlYZtS536KVO8vAUto6eZoqWP8s+9wnT2piLF6WLfxGam699RyqgH6wX+WzWPuijwAnrHkG420uG6n0jPrLfn7Ms4zUZfF5rxlG+8rEXVbTequ1WmIvVpHogWZqR0rR9mVPxTWEsoAG45keBbfi3KbPWBdm8E/+OzJGA6N3Y2X4FeHGdNZtWNCAnY1MDJ1qd6lve8kRpcw2dDnYTPb5KrdOXT5rxiISm1SawJfYZyCux50OMb8EVKmnCAISNtcTycqIvNohqyOAeslWhO6NnG1HYfSdbQTPo5lZjS9RO5+AziwAN8SpfgsnsyBO+UjzKrsMrPhOzJEmkbyVmzwVC+RELAcbLT3A8oavGlek9sIYOhlFwRTYb8/4+V2vlJlBWmqJeBAyFYo2Ja56IfNSSXmKmdeco4gHYhEXlnZVWfVh5chsSbOzKC9o7V7fvvcAp7shC/WUGEWAI8PQRCh4aKdzarjoZUBFqEg65FnMYu3taHhqHJQ09mT9+SFR6UcoQL6ZNxTXra0GvQVXwEv6vpADfEzcLWvbnO+kiq+hM84KsG54/N/sDtMglU6d2xD6asRpthKWL9zzCROQMXMR7NP+nBsFw34HHXVJ+nfC55ARAl45RiHbG+J2R3ubX4i9lFSHx+MMVADz9TxNIJHxxmCKviCNoPNxzJoq6+D4drT4BM/sIJ0v4VdY0hP/hZvCYRYnKdNaWUlSUZw48n54zCwkyYh97Cpo9e6+Ja+z8C9YTizxyJ8pXhB5voK4lVUSO40xupEeK+kKvq8J52zdfJMm5HLespJ1SHxbn85tIuHiyPZUNyWr1y+tfW3LANrGF3Q8mu9KA/JGpifamZLIzhXzauf0XrqsDI1Ly9+fd+sePiwtZlBI/VAD5A1EebgBp8TiBpgW4EZMFOKGKvMZeFWwyIJkf1fc9m4J2fAuiFqYHIj2uV3hDHRrnlaQTgk1B20VafDFVCydnGSEm00qvVeo1SgIbpZ3Hzj38kCoq4cspjMEOiQjT2s5hjBJV1iaTpVL2XD5D49PzGDHV1b+E2pbkUUObiArDgeWZLQQRcL1J9UbRnyfah+S5D/BEyT+7gVy4nGlsS7Mjh5JyCtzPPo8hJ6tDTj/EqxXhPJ747P9M2h04EOfE/U9QfBpDDXLfgLFBWwiYEDpffzAuVk+esSz6td/HwCUdrebOvwO9jKnR6RpDt2knqU9Tl+PItfoMd2FFkJJzKFzJ85drZmrR6126GJr12HW+CrvdcIlkTGfQlFHtFX5lFA0NBte/MD/vnunDZUA4Mj22Ex2DXbS6A+3MQCzDgIi0QLqa163zCtAReGNhxVNeO64Zn9OybEUmgqg3W9iYK0dvge8s7Bbd8QR8ET2TL5IZy8lvrMccsb6Z+hRHk1Nzw2cNDWGMsA3fqUIVotRXVCcGmb0UfPZOxRUexQBzVnT+QEQ7PL7JLQZ6vMeETmcFtBdQz6Z/oKRXn6UTScVmIss7g= ---END GANDCRAB KEY--- ---BEGIN PC DATA--- wfKD6iudumBkmpL8IRr4U4exEVaoOXLtwDwmOrT1y1YWvOiWMx5GYaRdvZZRToRRtnYT7mpWtbfBTGOHhh5qBJzzs9MC7736UkGSDDniUJJG8/LFF//kmGmoAZAGLo2j5/wd2UrxMJK+iqKhTkS3ArgAxrZOOOiXrbnhbWMkLHQnbYuWlMClYZxYU6SDxpopRo5r292AV1KIZBZV4APBuUHcKSIr2MWMI0O1MKIP2IpKLE2TS5wNmoQoAHZIP7k/TfrG1tVzlDb3jcZAB3gql9dnWN0lCD4xdg7bDNQrvH1xSi3FCw+6kfktKtizqdynr7r154JiurEmkUXBtuKl/zI2EOslGtNYbVqGBnPtqhGHEd4b9CdH4ou4Laa5Y59yPYyu2Qiiy5RtTRYqBlPKJPYJzJFqwNUoABPNnKk+C+5dALyfj2E+g6VrLg32xAxKxQ70Zi/pARFL3vLLNeah1wAZNnQURkOKJTmF1lzgdn8JmU3fjiyxQQxnz7JBlpawv3IDVYfpfjfxfAIcOsA2PzRNwX8PQy7ChaZPEubtMkioBZdMaZHjHssOL7+KRYAP+4kgV67utbOZzJr9ZHY= ---END PC DATA---
URLs

http://gandcrabmfe6mnef.onion/f1d13815d7a7eeb

Targets

    • Target

      rechnung918738.pdf.js

    • Size

      17KB

    • MD5

      f5d402b4f54bf7ad7cf0328b4cddebc3

    • SHA1

      82fc0558cf21ff062145e48e76821ecd5d10bc21

    • SHA256

      00f77e0d744bbeabb6de0fd2278103d7e16bd6875aa1481fba97dc21f4f7c0d9

    • SHA512

      256328a635b86e8ccea3163e95877fd5ee6a50f2d28707c9a6297c3739b4b836587760954182c19d4ca042d06e9293e13ef705023b169294179568cb0bb1214e

    Score
    10/10
    gandcrabbackdoorransomwarespywarestealersuricata

    • GandCrab payload

    • Gandcrab

      Gandcrab is a Trojan horse that encrypts files on a computer.

      ransomwarebackdoorgandcrab

    • suricata: ET MALWARE [eSentire] Win32/GandCrab v4/5 Ransomware CnC Activity

      suricata: ET MALWARE [eSentire] Win32/GandCrab v4/5 Ransomware CnC Activity

      suricata

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Deletion

1
T1107

Modify Registry

2
T1112

Install Root Certificate

1
T1130

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

3
T1012

System Information Discovery

4
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Inhibit System Recovery

1
T1490

Defacement

1
T1491

Tasks