General
-
Target
4c8a472d658ec51a4e81413b2fe81db614fc3676d69ad6eff621fa46ae4c0b07
-
Size
586KB
-
Sample
220712-gk9lfsdgan
-
MD5
c50124240410641182ec735cc8ee9b9a
-
SHA1
17564c7bfad1d4066d3b07e686a2d4f9b9415f6a
-
SHA256
4c8a472d658ec51a4e81413b2fe81db614fc3676d69ad6eff621fa46ae4c0b07
-
SHA512
8dfa088e750df0785632796b406f36126c7f28a09043db7d4cfb67cd72c355bb329f9b6fd2f83b9a1a2ea75a05a20c3a6bc09c0c5c215b26f4d4a3d1e2613566
Score
10/10
Malware Config
Extracted
Path
C:\FDJGQL-DECRYPT.txt
Ransom Note
---= GANDCRAB V5.0.4 =---
***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************
*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****
Attention!
All your files, documents, photos, databases and other important files are encrypted and have the extension: .FDJGQL
The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files.
The server with your key is in a closed network TOR. You can get there by the following ways:
----------------------------------------------------------------------------------------
| 0. Download Tor browser - https://www.torproject.org/
| 1. Install Tor browser
| 2. Open Tor Browser
| 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/6b02f5bc863a74f
| 4. Follow the instructions on this page
----------------------------------------------------------------------------------------
On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.
ATTENTION!
IN ORDER TO PREVENT DATA DAMAGE:
* DO NOT MODIFY ENCRYPTED FILES
* DO NOT CHANGE DATA BELOW
---BEGIN GANDCRAB KEY---
lAQAACXQcLsJqgXM5hgyumUp48rV0LDlClyCRKrQ9eqw1v2M0TlWXs3BV+b8wENWSJZKsxWVeRzsaF28bbpZDs7KtR6X5tSG0BBsoPdiyZgNfBuG+e0DYAsGlTe7euSfxEVQEbau4V9fLFNQgUeKGq0uiMK02lXDIryIDoXwnCGjRcwhhlc9iEh+LnYrnVkrMmOvhezNWVERsMDhAKqEcf8f50fqSu2PROE6dmlmKRBQ09rJ7kUqhLquX7ptmjYFW/A1n71tNqhQL55f9JR57ITnAwrh1Nbknq7caA4nWf/4dChU7oSZymoyjDdiU3iEScH+F5C4Oaem/wNqnfVOg8rjtQBbpSgRIvpHrR9wy3yxO53U3NaEBd5JkowRv1hwNjBRj93VdVSJEFesHeRXluK5xNXspWtfAzpiqbrjgg1q5exJz8am4Mf7mIi4KGq/FA6bzC377atx9jB26u1CiLEgqE34BjPXzLxv5ZTkd9T8RqwDlcjKcPYrhqDfn99Ug1ymf51uouYnbXREnkr+/3hHGX+4H2Q/NQ87zRFGB5zjJFOyM2YiJ8SKg10eVntJrWWfBGD6fsX9F02YRHbFnRCowlpcyCJRL3IFcFWLdw/mn/zjDOD0YiLp3L7Z3c/gl+K9kfvbXYhteF/MEA7AOquhwZ7HNhvOHQXPs/tREK0YTxF/90YIFpJUfIezXoU1y2mV1eomrF7wZ5XYXtF6Rs5BF3eXGP4OSM1EDzBIM+3pZ9aThi73aDtzBUgtDY4zWmQATH8vXgzRuGBCp3PcKB+ntvtK5KEUbd5P3kSFd/LCXzy5LCmXXSm0Kean3r7myPXFKkec4/TJOkJh4WVFTdTY4ZFJwYISsn2luOYLO4R+cvx02jr+14nYQTme0QPIhuK7mCznjSREdhm/G6Rxo5HdIrXGcvY0JlSGWzIQWOZLhNq75ccyRQ1O41iiOHFqSgXBb9nRjyeTh4EkgmZfsu/ZRoRagnDBHl4uRwQisZFPOZirMgikgG6NVM7pzX7BtTIkqaTjVPlISmaGWkPZTg2vmKPiNNF0uxEciBcjF05BYuk+l4bmO+YWSHAXJ6ZCvDMF/e4iMSZxR+vrjNIWrW6u4/6Ewcqq+Ykx8bcdQshmiJyRme3tOopepY8T6FyMxLVaTngMkTjXkDqNsv7JRQAZyA1NJRmuTTl6wiq6imOHMtCBjgLL+UgPunA6Hm+cijltIizBVcuqJkkXN0nIu/z8n2IDwbTuEiNjidcIIazWBXd1d2l7l+GWRvDnCVlFnDE7iQj35D0Ee3kaNRITW+yulVj67KDpYaxIStm0gisUi7YGYvpM+VmOl3efn2z20HvXvoe6rBBy8zKJC7jY8q6K3Lw0t3VD5Rx+F2rv6rx+RSlhE2BO1pXrmFS6rR1WmJidDJ4Znr68YqcXteR0/VpRctKSDLVsRPAosMVlyU11fbeAYnzMsYNOyGM+Ki/zC9mzp7bazV4iFFKUjo8Ij+gMjYKZu3dAxApp89JfKK4C2djMzsWBjybQ75My+i2h2MdQqI0mb5FGh/ERBxbBh9Wq234EYvaqf9RCmlixT/2PPt4jhoYNYVACBowbBd3iTCcX5dvOlDzhaAWOlR+JXbFao5Ig0/Ck5higqOVZLakPHSFR6K7bj3hj3XRjNBVTe2bIrV5bOOBvCYmYatODrPBoF3VfSZLApOEHADVbwxfC9TwAo+Ecc3/SIUT8dzf/tgpfo4bUZbbhFAsTU+ZmgB5z4syYR5wQ1rinmxBuF32M00Y3OgXqfr343SE89NSePk7wTmMXXWhRfqRtSNucdGNwViGscRW4zYl1jUrfcNPQ4CgNimQ69oqr+KHqZeWHOACZAbGX6B7q9gICkhsXgTSKQ7o7bODYHG9j4dXeLtm3p6uos5Y91BML0WrxdI0CEHAqSWk1PeEjvosrymn6Cocjpz8C4VhddxAaOvLJ/8Mynv82zUrfWCDenRsGBV6IekZI1DJ89+Qy2fTnqYF9RTTk6qEXw3HOwDN8LRQUrMcg8AABRAmw+1YXArnWNfIyEyRrqd9Km60jTN5smyWR9eYciSGkAVLxvxfJNULIvA9MqEz8Zfcafjkxz25lo2V2d2afgSQyRAwWGALY/8mOGNP3LJPpuzdcBTe5IpwJcYoTa47sUdAY8HRNEIruuzjpqPMmd+n6DITUc6gjBYaYA5qsRqgvvxpTk3zvjwfRFhUV77fvojsGaQ5N3+6xrcGn8BFaBlFgIng=
---END GANDCRAB KEY---
---BEGIN PC DATA---
wfKD6iudumBkmpL8IRr4U4exEVaoOXLtwDwmOrT1y1YWvOiWMx5GYaRdvZZDTpVRtnYR7n1Wp7fGTGSHhh5qBJzzs9MC7736UkGSDDniUJJG8/LFF//kmGmoAZAGLo2j5/wd2UrxMJK+iqKhTkS3ArgAxrZOOOiXrbnhbWMkLHQnbYuWlMClYZxYU6SDxpopRo5r292AV1KIZBZV4APBuUHcKSIr2MWMI0O1MKIP2IpKLE2TS5wLmpQodXZhP6M/UPrO1sZzkDbgjYlAG3g8l65nVd0/CBUxKQ7KDJYrtX0vSmnFXg/ykfgtJNiwqfCnqbr85+Bi5bEgkUjB4uLy/2M2Q+t1GtNYalqABnbtqhHSEY8btydK4o24b6bsY7hyY4zV2QKiqZRuTRsqAVO9JIUJp5FtwNQoBRPKnKw+CO5XALafi2Epg65rLQ3qxA5KyA72Zi7pCxFN3vLLN+ah1xAZaHRCRliKfTnY1lXgYn9OmQ3fyiydQRBnybIjlsiw63IKVZjpOjehfFYcP8A6PylN3H9bQ3TCxaZCEv3tKEi+BdhMPpGxHsMOI7+QRdQP94kvV//uurM=
---END PC DATA---
URLs
http://gandcrabmfe6mnef.onion/6b02f5bc863a74f
Extracted
Path
C:\QLMDROR-DECRYPT.txt
Ransom Note
---= GANDCRAB V5.0.4 =---
***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************
*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****
Attention!
All your files, documents, photos, databases and other important files are encrypted and have the extension: .QLMDROR
The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files.
The server with your key is in a closed network TOR. You can get there by the following ways:
----------------------------------------------------------------------------------------
| 0. Download Tor browser - https://www.torproject.org/
| 1. Install Tor browser
| 2. Open Tor Browser
| 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/5a4b6daf45d76d2f
| 4. Follow the instructions on this page
----------------------------------------------------------------------------------------
On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.
ATTENTION!
IN ORDER TO PREVENT DATA DAMAGE:
* DO NOT MODIFY ENCRYPTED FILES
* DO NOT CHANGE DATA BELOW
---BEGIN GANDCRAB KEY---
lAQAACXqwlSoZN9PddO5r8oez+YTwswKLDZaRs47j7M3C7pU5R9iEBeH6jaTJy927SuHxNF/j3GgXhtmcdjZQW9XS30I1wmYCPy/4RRzZP1If6HA2zBqPlVjjYflQr7DpVs08++ri6dHy4v6sgA3daBNkUcsSE1+XidrFa1WsAhMfP9dgBIsyGs6GC25tkxOXO3x5DDRXHBgDFOJVv+Thn/6K34rRy3JnVlMwMr4HR9qreZWu5/41BcJHllN+D2I889lV5QtoafHY/s/dOVxJVuM+LZN4/i02PdrkwOncYmdQ9Yk6p6A6vV0JEk5D95CnDB45x8quGP9kBq1V9AzcXdd7mUzCs/3ulYx5ycgJaTcORNB/1iD1aMuL4H1AzQBaWb9kaftsGRq4DtB00pbv24Ao4yKARJJ33PYKrVxBykTBo7LfrI6O5bMY8mnfGZGCPvegXAPeQ3zwtcbog66Bc5RuCpnmt2U+NoOS2IQm7W+hdFFNfAB5hleTgqux6b8GZaPkDPi/lls1nLDrTXCfFV8uEeBNgHbn5EDzR1O++sYJeKMUoFVpXZ5Za+UQfacQdW5iqK6QRg/u34Q4Ao60GePP4dcMCbjJSWNNM2HibZi/Bt6H8OU4CQhMX7ClWMnCwZt6Vyi2HYCNHqc6o54JH7xxRF4VPbjVPK9YkbE6il3NZSKwasFDXOqFwNQHKnrVSBJJMxnptcGMGBeAD5ilpIkEy8M5+29wtns3rDRVa2ab18lgAPhFYRK24LCZsraFSIpWW83xPs9Y6qChFLgdSSQAMla6UT5cIhGnOyBrgvt5O2KMBFJA+7axqlUf29YIqkvcm/mxcsLOIScmQbo7MmH7e/+bukcdH64hdAYaYTUlZMxuswz4NLe+1NnHZ3Kd7pqlhIJaqmEGHZjZ4hOqsZ8FHHNOeGGL9LROzwtqmlDcUpl/9+GBSQu4EVzzsJck7fxi4z60Sks+lzDcISpVT9s54Sbn8KOSrWknr5ik/3wwMKxeeN5geDZCGqPs8P4ZJx69TBDQ5yACrwsqu0FreJGEMBaKXzuMDT9JWzVi0rUTcjgzUvZFOqGUL1pkH/XYlhNiEbbLqs7WO2/TVJNUoeBNF7z99ynbnWFpQh1EUUfgjpYjgGPCAdvUSGoJwn2S2Rd3fqe8/o3BZWiKKirWBXNoZcIcaf9YYwrC7G7XXkCBTju4jBIaghuCpRbM6Cqk6droyawMCkNqhBi1W0Vhyuhi8URwhRXYottjOceC48YqhgfeGqipIiXu8/+TJTkJkQA4cvrA/0uc/UboCwd1qFjNd30F9fL24nXGoLS6/tAnhGQP7oJFQTBOV/mn45z52hF8IWC/lXVkzQ+2Vf80qKp2/A9dZU0l3slkuoB//jKz5gWOfnj9o9Ghp+YPBnS2pVvjStmMpZdTg4YrjU4k+cSUIuS+Gvdt4MA+HS9zPBIp58qVrwha5BXHinMnyv5vVXkwAtGGRHbMLitpabPChkQ6HW1V7GdfcmdUdR86ktqcGucXtYlO77Vwo8pYkwds8GpiXtReakeGKYYlCgONId3ZONtEDVfnFf4lmB55zLjK/04Cai2Kx6xvFI4kJrB0m1fgQrr0/dkRo45hF+BLxf4xmnc/oLRmB10+uPrEW4e31ogHLc/gOT63lNCEq0pz/XuKrVrrex92reXBPlZpDFxmDNe3AD9VFX0tlYxCAv3+J6sMskdhJ5DN+pJMqMEkyEZmqAreN5gvfOJEEoMztFh2YYenYRmMI61QSMjBbCzXp/Ds4A5+lMsYj7I4q5yrsp8JH+rAAHfLIY5UPpBn5Thp/cSCD44yYfNKhjrBBsXWeopXOzg8C2uxjMoXRdG/kBthcL8389N5E9S3eJp4RnSGEZpBchr/cGgQbJy6CB7FumgtmfbL0q9rlZ0Kg/E5efOkEwiSQBlJ0x0L7HCXx3UWTazcg230DOF49tPbe0LJTStgNH3jv/bAqJGjYbMNhMThZFvF28uFMSkmoNNupqN+0TXxWKA9DJvA49VoB00idYFDtq/AVp8OtixCq8X5enUdfxDzgfuRFGdc3SAbIuNdMPqo2xFbBGSzYLHlukxvb6OAElBZeK+nidDbwb+5Sjs59A0WX0p2RsMbAQplBRmzQeR4oAMoCE6fKcUcrlyCzmA4TuBcYRq8BTDkr/61U3aTBRwzJhbSN7XTHKhT7rn1n83MqvaSCEqpQY9z9P0Ve4vvAGhNXzP83oH/0/WEmztrDSzhxs=
---END GANDCRAB KEY---
---BEGIN PC DATA---
wfKD6iudumBkmpL8IRr4U4exEVaoOXLtwDwmOrT1y1YWvOiWMx5GYaRdvZZdToFRtHYX7m1WsrfPTHGHhh5qBJzzs9MC7736UkGSDDniUJJG8/LFF//kmGmoAZAGLo2j5/wd2UrxMJK+iqKhTkS3ArgAxrZOOOiXrbnhbWMkLHQnbYuWlMClYZxYU6SDxpopRo5r292AV1KIZBZV4APBuUHcKSIr2MWMI0O1MKIP2IpKLE2TS5wNmoQoAHZIP7k/TfrG1tVzlDb3jcZAB3gql9dnWN0lCD4xdg7bDNQrvH1xSi3FCw+6kfktKtizqdynr7r154JiurEmkUXB5eL1/2I2Q+sgGo9YPVrVBiPtqBGCEd4bpydG4tu4bab3Y5NyPYz32XaispQRTRkqF1PXJPcJ15EHwNAoAxPMnKo+DO5eAL2fjmE0g6RrIQ3vxBFKwg7yZizpCRFF3vPLNeat1w8ZN3QQRlGKajmI1gXgeX8MmUHfnCzkQQpn2LJ8lqCwsnJaVYPpezf0fBAcasAlPyNNwH8VQyjChKYcEu7tKUi2BYlMc5HxHowOLb+dRZ0P/YkhV/3u67ObzJf9ZHZZhw==
---END PC DATA---
URLs
http://gandcrabmfe6mnef.onion/5a4b6daf45d76d2f
Targets
-
-
Target
4c8a472d658ec51a4e81413b2fe81db614fc3676d69ad6eff621fa46ae4c0b07
-
Size
586KB
-
MD5
c50124240410641182ec735cc8ee9b9a
-
SHA1
17564c7bfad1d4066d3b07e686a2d4f9b9415f6a
-
SHA256
4c8a472d658ec51a4e81413b2fe81db614fc3676d69ad6eff621fa46ae4c0b07
-
SHA512
8dfa088e750df0785632796b406f36126c7f28a09043db7d4cfb67cd72c355bb329f9b6fd2f83b9a1a2ea75a05a20c3a6bc09c0c5c215b26f4d4a3d1e2613566
Score10/10-
GandCrab payload
-
Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
-
suricata: ET MALWARE [eSentire] Win32/GandCrab v4/5 Ransomware CnC Activity
suricata: ET MALWARE [eSentire] Win32/GandCrab v4/5 Ransomware CnC Activity
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry
-
Suspicious use of SetThreadContext
-