gandcrab

General

Target
a1900e34fbf2279d4ff96027156f27b3_JaffaCakes118
Size 230KB
Sample240612-v9179stdka
SHA256 071829bd858ce263733337bd3ccc4a1976a3f582aa50af31815a2edb2a692f01
MD5 a1900e34fbf2279d4ff96027156f27b3
SHA1 5dedfc6d264d0d14646599dc327f5b11e8fc2d23
SHA512 b6cb92a3653afff91962a5a72bac428930aa36e020f71570069d249ffe8297a387da7f6d8276bc01c0254faa2e961989a45f1471bea329d06e95b7972ab79fac
SSDEEP 6144:PcUDGbFW8W2W0EruXdjC2ZmY8wJcm2atN+bLkF3N:0ueF3W9iXciR8wJcy+bWN
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Path

F:\$RECYCLE.BIN\S-1-5-21-2721934792-624042501-2768869379-1000\DFLQQ-DECRYPT.txt

Ransom Note

---= GANDCRAB V5.0 =--- Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .DFLQQ The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. The server with your key is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- | 0. Download Tor browser - https://www.torproject.org/ | 1. Install Tor browser | 2. Open Tor Browser | 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/351e99ea10bcaf65 | 4. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. ATTENTION! IN ORDER TO PREVENT DATA DAMAGE: * DO NOT MODIFY ENCRYPTED FILES * DO NOT CHANGE DATA BELOW ---BEGIN GANDCRAB KEY--- lAQAAM3gayQYJq3q/6gRAJTCLHk3bnYunItXHsZ4p6PE0YrhDm2O0voOOxdhjZ+BuW+VZlMeg3sBZ1vJcDV+jVIW4bG+AAsvvqQdlao5dmOO15ZpkPxwpJMt6r6lmJpkAM8jzAbWfYrseZOdU6DURw2B+wT+uAdsvaSBGtSYerxmaAdL/NwOJMaPi0iukgxydLPdreKAWZTKwgFHMBOvQTBFixtPgSe7Uh134zhpCt63Kg0CJ9kOXgvDKdYp9CgLsxW+5dIXCFB3xRrnPODmfq839B3gLab+A6vLlRYyO1QkbdXpuIWc1ICdYgmbRWk0t3XqCf58i8s7JsagzLc9XQo+qqfqjD6reHnbJ7qEAjjwUwVLwFRQLb6n04Dhac0nywMt/FGEhozS5R9LMf8xGzsSlEaMuA9TDXn7WRC1RgtH+QOoYB8bNzskdzBeOHKNBC4SHdKHRIA1O9k97dwXosrcmeAi0Q4uZxNb6v6xL4Z15VlkUmyHz84uVZK3XdB13fqVAVZnXgud0pluHODwJ+6hTQ8iPRcdVH+jQJPLdKF9z+6NFFzP8ehcduH1GFyTInInX+tum6vaia8gHreKCLLYm2Dg8AwJFmKok87Krc+jjkutiIJS06TjGlVhRzGczRGZ9gLREqlRgrAxMPWbwQmN2BfJAKj77XIONbI3BJlswj6qYPTEL2gppZg08Jo2HuAEKCwopz5aq9fEHoZmgPkHpSxK2F8OqW66zUR8dOptx1YiUDj9YaABA/0zxLrQaGs1kKcw7I03i9OtHYtv2sUkdXvjX7/Tcn6fmVPUUBb+cDV4lxiVPmJ35PC47+VjupCeR1cwVVOxmsJLLZ5KmzYeceYclzGYlhEZwrUt0Zn5spUWCWniuxuruopii77nIv3VMGlj9IsIYyQ24+CWeyGoNMeu+lL74agir8G3Rj55ea46e22f1CkIgks3VbSGKpG3bBky6MexS4Zz5qg/cguuW3cTKn/iOEGpnCGLgB8Gd40pFrLCFSYYetuo7LTK2WGfwy8O7GZwKF52VqnZ+nKdoGU0MJVYfrJtJYb1u0ZKiQ2DMmYunvWlTjOTlgD66tcvv6f1jcbAklvxCO9pjOe3Wqhxx/l3DlUoGl8ynKNPGtpXM3aPdfzHr+z545RTadoGbvg3kv4CJ8pXOfZzDQo8DKZMHvstBGn74uvcNt9NZTG6KjkyVEi6SAA9kjTXRIQWwPM8k8zuJJNIoSrBbp+q3vvu0W5gm1yoHHnWYYfQHlvWoEtdzeSClQtqpSb6K6/uFD+ASldm5ICS6ICT+V0SRC9doh6pya0RTyHB0TfcqKgatah7FBaBZN4n24zR3DOrvimQUwWv/dZwHaKG07xYgtjoNh9JfryKNcwmiuRWePsyMd+Mo3RRWxWf/eQv477S0himgO6tJILpJFpOnvsrRUP/sCBc/pvjJFzZzGXhmSFItlWbY05diTKFWU+7M4zeZRYWuRCYYuHDp1p3jIclOsCZmNGcPEOJgPDbGPiL9W1E7qnfs1DQk9od5+cl4wCEzGqKe/hRzvVdp3ybmm7W4t7b8m+O1sek22BdGFl8PDv1cDnEGni4OP0h3R3yaPyYEjzzEzuoSjZ0ca/TLCn2sefFMs9MNEyWwVKmIqz5cmjGu4dIEq6YgFdIrqeJynFG0Fq4YtSbcNlt6mTQPhy6HHnCBweC5NqMwh/s0SeUErQgQgy4OwtIWHnPZBTNcUC5NPmru3Ll27PdAeLq1ge47sb9KOlzCjs2AkNEJzPjPxnT03lSII9Wd7K6rdaiakFrLdGizv/D8aDriyDZ1xj/MU00SpXVDzvokkx9z773KGs6+JdaNUqX9Q5N83B7owRSuUu2Hlu2RT8Sg6T7vSlOGSB+68ZoDeD1F9+TpJkgxJLkMZnvEl3cMUicsQ25Upt0kbSZJIplW5KmoDZvaYSJb1CIpQ2dyBaQY+UGgUd7ny6FWJ0CICWup+YkHb1g8U3+ahCfZS+bM5pkw+Vud9/JAOh3UXIHhDrHw0X/X5FCt7zcWI6E9N0SYWCFu8iknDOY0TWOgOUHo1EYi+FfoQ1aL3u6RM1WioqHETTPxafbH1aRxE3iyZX+FBlI9w6/CEbkW8FjwgVdSgCvJnOLjtXQyYjyCTfmwa5TIQ3FhJ6cgfYOmwVpWpBhI0LtKQgBK+HwDYMh1zPS/eJY62jxnJpbGCy46TKG/Z1BH5jKXX2L/+u1e2H+FF3AUYeWyFrN+GWA82Tgxqg= ---END GANDCRAB KEY--- ---BEGIN PC DATA--- wfKD6iudumBkmpL8IRr4U4exEVaoOXLtwDwmOrT1y1YWvOiWMx5GYaRdvZZVTp5RrXYS7nFWv7fdTHmHhh5qBJzzs9MC7736UkGSDDniUJJG8/LFF//kmGmoAZAGLo2j5/wd2UrxMJK+iqKhTkS3ArgAxrZOOOiXrbnhbWMkLHQnbYuWlMClYZxYU6SDxpopRo5r292AV1KIZBZV4APBuUHcKSIr2MWMI0O1MKIP2IpKLE2TS5wLmpQodXZhP6M/UPrO1sZzkDbgjYlAG3g8l65nVd0/CBUxKQ7KDJYrtX0vSmnFXg/ykfgtJNiwqfCnqbr85+Bi4LF3kUnBteKt/282ROt3GtpYbFrRBnTt/BGAEd8bpCcE4oG4b6a1Y8ZyGoyp2Q2iuJRzTRoqGlPQJIAJppFrwNIoDBPOnKw+A+5ZALufjGEwg7NrKg3qxA9Kxg72Zi/pDhFJ3v3LOOar1w4ZLXRgRl+KCjmo1jngAX95mSffmizzQU1nmrIqlsew6HIMVY3pdDfwfAscdcBnP3FNhn9WQ3XC06ZCEvXtdUj8BYRMbJHzHpMOar+NRZwP9okRV/rusrPFzMP9PnYFh9gzrewdRb9tHf+DbmDW4OIcXpVeLdQr9FRha1KO2vpgy2mFLQkzlAtXfjb5QmECiQ== ---END PC DATA---

URLs

http://gandcrabmfe6mnef.onion/351e99ea10bcaf65

Extracted

Path

F:\$RECYCLE.BIN\FKRDL-DECRYPT.txt

Ransom Note

---= GANDCRAB V5.0 =--- Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .FKRDL The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. The server with your key is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- | 0. Download Tor browser - https://www.torproject.org/ | 1. Install Tor browser | 2. Open Tor Browser | 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/ddb5ba01b5bd70b2 | 4. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. ATTENTION! IN ORDER TO PREVENT DATA DAMAGE: * DO NOT MODIFY ENCRYPTED FILES * DO NOT CHANGE DATA BELOW ---BEGIN GANDCRAB KEY--- lAQAAOHXEn3n35oEBDRHwgzgOsiaw7T3cPojMmMiwLo1mTXDBAvTyhaZHn9/QXnyKJz/ejrz9YYP71NNHZJzkQQNg/zMdXYdY1G2dBBIyI5bfftXDHCoA3XgCW88228at56zAevI8n2NQXyEbl+VFLj/8c1ToM5v8ItYQVCnDHlUZPExjcWQGWMyYm29XxTr0qS4+INJRHCDO9d+W6YKCJj5ukydzaoIoob2pHeUuyyWbU9yzPjjER4upPdbUjBXXkU20ObXXK4sPmO5RvQYrpZDvjDQILb8Yavtl6/fDShcOzFYnuA12vxkM5NDK+cvHProLcfDxRX9vXHUS1bR54BYg8KGWQHE18P/IRmEqUOxuwzSakQv7vTiqV/rJ15EIzOUs2i2NAwFaVIKEVx8rtKbA1l9WXJdgpv95BH02VZUBDiNuQfMoiV/04yoFP70GHcpHOP3DlLvXcTxsmrEElSrM+Jv1FpRC/qI/dl+Il4aNWA5+X2yBoJCM1TeePEM7ghZlnBniUXspHlvoF7heDSeKbBB7bsDFDD8HBhoQIqw3BsN9HftFdDE1M8BB7Gu6JJ6mkDaCNubY8IZwvFFiwcO+wUioo7XPIaAZrYYv2qa7zg5j0WNYbsBLj52eQZt1qLrZqYDe6eeMBvziSHRtWxsJRbviDLMvdngmFzy6S5zGFBfER/4f3vRUQTwwwfwCrF7Y2ZOhWvw0nE7s1D0qoc2Do3VNam5aUjyexyG3ah+cSUts10X3gJb72P9Q2a4ozGvi4ufqUV4aQmABaw4Whg6pQ+Qh4zIuKdLKkQljbPgUStFAekVQk0R9w1x+OzeVMWH08/E9QPs8O3vcFJetVVnveHY40bSo61nAmFhuIVa+0tOuE+wtia4djTIdwm8GhlR4gCQN3B96i44bcY7kS9Q53vLcNhYYEusP4kobWarag5+EeUdKE1d5Dc+FdmPga7elRg20uuR3D1LaEoxSIfDTb3iR91NBPKFjR6q1Slq64w+3gDsdrX2CystkBvzyqUHYe4NErG4ed89USJCZmb6EfsI8hzl58JKA20wpHhh+kJDDkHiDcgU7/yqdZaflLDwwmonF37p4o2+gdidgBrl645s9pRY96eQBIWf5I1rXGEp+S9Y8zzaBoWDC1S6VDFkUdCGBQdbpGpL97t5yfdOtIpoVjIa3SYKvQI4Uf2HbEYsCPNUoYisB4FoQuKxJ17rKkdKd9qV7l8enpp6m9txn5EqLXFLNID5GGvcpBInDqN5k8IGbOKwmLDv4J/aQYBSioPcgYXWFGwpMSPDbCXluZxPD+r1nx6r/+aHQTIl45eS1CBPz+O8/0K8Nh/WTC9K3fi5n5nSjOKL5iQA9NveD60cakOR9n2/Hdu6iUb55Ji7O7DWBqwbHukFe1EBKoalCJRKPqtjOu4MHKjTY4iOyZO1RMchJ1K4t7dwCdNxUfS7BpWPKsSL7e6kxUhodEjiB3CQzV/oNEko3rv9Uq9pPSww334rBDo888JkhFiF9ZSO74nltd1L0jSH6Iak7V8NdkU19SeOV5id4sViL2XTZe42degQOHa9we89rereCpTMaPLGbV3QVj/6hyHlHGC43FDBU5+F6oGYg5sQPUqutjHTZRx4bt6vcf/p4Qe1bJ19Ul/pOAyQUHq/3IG3ADD+QPLVa5Ha3UD6XskOo+mDJD13pyg0Jd9Ohm7Z3ydw02dsnc6SnNp0564JCQ7m1HmpWjYV/DbPnlJRG6oiSpfmtlhk5+TgGilc9cFGZKqfBA8e8pchEP1iY/K3cBO3vU2xLYuZNyabwE23+brFWmpSRAgafbY1BK+D75owiOEhNjoAls0x+BWrfjEtfMeIEqMQsv2MuoYMyIgEGgMGTCkZltVKHOMqFh0x00z0fCQq6kgre9FbmChZlKJIseQ/ITL9Hf2E3uZLAzI8KRlki6ymcZJGijwJ8DzYrfgYNoLTK1Q//czSNmfSWY8776ybSn4GlbD+5D39pYqtQQdZMerts0bRr6KnvmXkBY9uptger7F6zDOH/xwJc9oDBTYwmnSjsR+CMXjZyOz1BSTzj60KtxtRbAYUaP+ZjOPkpCS4W7ePvs+n2bJ3zdgk60jkvzegwahz5Y3rrfm0sibjcqgtw052Rj6baw9pX7GMoUAQS8knl2DgIRu1B25RNtWU9l8NJyabS3MCZf78dhfAETYsmmsFcM/1kgzMMH3STh/NlCSqH1ZaD4iGJWhitRVIGv4/i7SEBgc= ---END GANDCRAB KEY--- ---BEGIN PC DATA--- wfKD6iudumBkmpL8IRr4U4exEVaoOXLtwDwmOrT1y1YWvOiWMx5GYaRdvZZETplRuHYJ7n9WtLfZTHSHhh5qBJzzs9MC7736UkGSDDniUJJG8/LFF//kmGmoAZAGLo2j5/wd2UrxMJK+iqKhTkS3ArgAxrZOOOiXrbnhbWMkLHQnbYuWlMClYZxYU6SDxpopRo5r292AV1KIZBZV4APBuUHcKSIr2MWMI0O1MKIP2IpKLE2TS5wNmoQoAHZIP7k/TfrG1tVzlDb3jcZAB3gql9dnWN0lCD4xdg7bDNQrvH1xSi3FCw+6kfktKtizqdynr7r154JiurEmkUXBtOLw/zQ2FOt0GopYbFqCBnXtqBGEEY0bpicS4ou4Oab3Y5NyPYz32XaispQRTRkqF1PXJPcJ15EHwNAoARPLnK8+Au5ZALyfhGEwg6hrKQ3vxBFKwg70Zi7pDxFM3vTLNOah1wYZNXQXRlOKYDmn1lvgAn90mSDf7SyGQSZnn7Ivlsuw7HIKVYbpfzf2fBccdMBnP2lNhH9XQ3DC2qZAEuDtLkioBZ9MNJGhHpcOfb/IRdAPsok9V+butLOnzJ/9bHYIh8sz7exIRettGP+Pbn3W/eJIXs9ebdQm9EdhJFLd2qhgw2mJLRMzwAtbfjn5E2ENiW4EkrJfTw== ---END PC DATA---

URLs

http://gandcrabmfe6mnef.onion/ddb5ba01b5bd70b2

Targets

- Target
  a1900e34fbf2279d4ff96027156f27b3_JaffaCakes118
- Size 230KB
- SHA256 071829bd858ce263733337bd3ccc4a1976a3f582aa50af31815a2edb2a692f01
- MD5 a1900e34fbf2279d4ff96027156f27b3
- SHA1 5dedfc6d264d0d14646599dc327f5b11e8fc2d23
- SHA512 b6cb92a3653afff91962a5a72bac428930aa36e020f71570069d249ffe8297a387da7f6d8276bc01c0254faa2e961989a45f1471bea329d06e95b7972ab79fac
- SSDEEP 6144:PcUDGbFW8W2W0EruXdjC2ZmY8wJcm2atN+bLkF3N:0ueF3W9iXciR8wJcy+bWN
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

gandcrab backdoor defense_evasion execution impact ransomware spyware stealer
- Gandcrab
  Gandcrab is a Trojan horse that encrypts files on a computer.
  ransomware backdoor gandcrab
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Renames multiple (282) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2