azorult

Sharing

Copy URL

Twitter E-mail

General

Target

RNSM00366.7z
Size

9.4MB
Sample

241107-tvcexswaqc
MD5

46837db77a1738914d3e706e47dd063e
SHA1

8dc5b42cb708a3cd73a0af71742be7ea39389c5e
SHA256

38d06336598e9109435116705fcbc60f0d30eb697805bf6c5a09d414e51dca0b
SHA512

358176dfb1035ee7c8fce38119a6723be33b1ac5328a7e654ec1b2000b7e729bebc09493bc709ef0753d7ca72ae617d8d486322fa3683d182f34f8c4de0499be
SSDEEP

196608:CDGWPdy6PA9f98chi0spA9RAx2CjDFlOQC7ChOr1L/5aYBnj5RnT7neXj2S:KGWVRAoFCPCj5l67zBaYBj5Rn/neXx

Malware Config

Extracted

Path

C:\$Recycle.Bin\RESTORE-SIGRUN.html

Ransom Note

<!DOCTYPE html><html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <title>SIGRUN</title> <style type="text/css"> .btn { background: #101000; border-radius: 0px; font-family: tahoma; font-weight:bold; color: #FFFFFF; font-size: 8px; padding: 4px 14px 4px 14px; text-decoration: none; } .btn:hover { background: #3cbffd; text-decoration: none; } .col { background: #001020; /* ЦBeT фoHa */ width: 60%; /* ШиpиHa блoкa */ padding: 15px; /* Пoля */ font-size: 0.5em; /* PaзMep шpифTa */ word-wrap: break-word; /* ПepeHoc cлoB */ text-align: center } body { min-width: 100px;}#container{background:#101000;}#container .column{position:relative; float:center;}#center{padding:10px 10px;width:100%;}#footer{clear:both;}* html #left {left:150px;}* html body{overflow:hidden;}* html #footer-wrapper{float:left;position: relative;width: 100%;padding-bottom:10010px;margin-bottom:-10000px;background:#1E90FF;}body {margin: 0;padding: 0;font-family:tahoma;font-weight:bold;}#header {font-family:tahoma;font-weight:bold;padding: 1.0em;background: #E6E6FA;}#footer {font-size: large;font-family:impact;line-height: 0.1px;padding: 1.0em;background: #E6E6FA;}#center {background: #101000;}</style></head><body style="background-color:#E6E6FA;"> <header id="header"> <font size="6" color="#101000"><p align="center">SIGRUN <font color="EE0000">1.0</font> RANSOMWARE</p> </font> </header> <div id="container"> <main id="center" class="column"> <article> <p align="center"> <font color="EE0000" size ="6"> <script> document.write("All your important files are encrypted"); </script></font></p><font color="#E6E6FA" size="4" weight="lighter"><p align="center"> <script> var hex = ` 94 04 00 00 e9 31 ce 13 8c 5d 96 9b 7d fe b7 50 97 9d c1 47 6b 95 32 56 41 df 80 8e 30 32 5b d4 18 fd e7 c5 d5 21 14 77 c6 11 cb 81 1a 88 e6 68 33 ac 1a be 80 d4 20 29 11 e6 c1 78 47 dd 5d 98 fa 97 20 70 81 0e 69 6c 5d fb 1d 8d 17 38 dc 42 1c 22 97 ac 60 1d b1 88 44 5d b8 72 ce de 52 20 ea a4 4c 60 f3 54 53 33 41 6d 12 e5 26 f7 38 df 80 55 58 bc 07 33 da 38 4b 9a fb 22 7b 1b b2 97 c6 5e e3 68 0f 3c e3 f9 1c 58 df ea 2b e6 c7 fe 8d aa 7d b7 7b 1e f3 cc 8d 4f a7 07 95 bb 9d dc dd b5 c5 75 e4 f0 c6 9b 02 65 4c 31 a4 62 12 7f 7a 10 9d 3b 21 6d 71 38 4b 14 d4 5b 38 17 8c 48 00 91 e8 5f 16 26 93 60 cb 1f a0 a5 2a 8b 2a ad 14 d6 21 67 be 00 95 57 08 3b e4 4c 7b 58 41 9f 46 ee e7 c9 9f 11 1f a8 62 e9 ce 9f ab 77 23 13 f2 b2 30 52 ae dd da b5 cc e7 4b fb dd 21 6a b3 a8 0e 0d 7f dd 44 11 6e 93 cb 09 2d cb be 2e dd 31 18 3f 2a 25 74 83 60 d9 6a af be 61 b0 b1 41 48 0d 53 a5 33 14 14 a4 36 c8 6d db a8 d1 b5 07 2f 42 4d 16 93 a4 2e 02 84 63 57 4a 76 5a f7 1c de 2a 65 2a f5 e2 9f 8b 9d 70 5a 97 ee 36 86 17 cb 37 42 69 e0 9c fc 70 be e4 60 ad da cb 0f 60 2d 97 e8 8e 76 9e 74 e4 d9 a3 49 bc 5b 6a 4b 76 ae fc 2c 06 db f8 a7 f4 d5 59 9b b7 4d 2a 1b e5 69 8a 36 35 b1 f6 d2 e0 96 38 31 c6 e2 71 ba 24 26 a0 28 7c a9 9e f3 64 2e 44 20 60 76 e1 58 35 c7 2f 24 4b 48 ff 48 d0 ee cc 6d 00 53 eb 7f 43 3c 26 6a e5 54 f2 38 7f 4e 5f 98 a2 bc f7 d0 0d 33 5e b0 65 56 31 9c 8b 13 fb 91 85 8e c0 d0 22 87 51 78 d2 9f b4 f2 78 0e 0c 39 7c f4 2f f3 c5 7d 7b 2f c3 60 a2 c4 81 a3 a6 29 4f db ac 28 c2 55 35 d9 89 ea 96 6e 31 e5 91 50 d9 f3 e5 57 56 62 28 3d 44 61 23 e7 98 76 34 f8 2e 5d 7e 15 ed 98 e3 47 97 af da 5d 34 23 07 90 17 30 4e 9c 9e 62 24 45 59 c2 e7 6c 2d aa a8 f5 4a 22 b9 a4 fa 9e de b5 fb e6 d3 8d 2f ab 91 8b 65 cf d9 3b 32 22 7d 6a c8 d7 ef f1 29 e6 49 da c6 3d df 11 fb 94 52 e9 0c f1 33 e6 58 f5 f0 34 84 a3 a7 85 54 c3 e8 c4 a0 30 e6 bc d8 ad 37 34 dd b4 0c 98 f3 49 f1 51 a7 49 4e 7b b0 fc 41 06 47 8f b9 61 cf 3d 23 7e 0f 06 8f b5 84 7b 7f 23 b9 c1 e9 ae 91 08 bc 49 53 b4 5d 94 67 30 37 a9 90 1a db 0b bf 31 3c 83 7c 23 01 96 f3 54 b3 77 e2 76 bb 3d a8 88 d0 54 53 31 d1 59 73 8e a6 c0 ed 8f ce 21 48 ab 93 1d b6 3c f1 87 9a 3e bb 35 f6 b7 49 80 cf 21 e6 f3 85 e8 00 95 c8 6e 4a ff e2 6d 60 da 5e a0 81 b5 5a 9d 3c 41 c3 e9 3f bb 19 5d 61 a2 9f 6a 19 d1 2b 89 47 7c b7 5a 0a b9 cf bc c2 19 5f 99 65 38 82 e4 13 fb e2 a3 bb ab 68 c8 4f 0a 38 d3 f9 b4 ba 66 39 af d2 12 3d 14 21 2f 5a 6a 6b 4d 70 d4 db 3e 3e f2 0b e8 b9 48 3b 3c 5e 59 c1 17 70 a0 e7 fa f3 03 52 d2 a3 f7 70 75 d5 93 12 d0 a2 ec aa 9f a5 b6 f7 7f 26 32 25 f7 a9 81 f9 fc b0 8a c8 19 b4 35 1f 64 5a 87 e7 43 a8 54 84 22 41 ed db f6 12 a5 f3 48 5f a9 32 54 85 8a f3 f0 c1 b7 79 9d ea 5d eb 5f 57 5c 24 f0 84 f8 14 2a a5 35 03 4c 3f 44 2e cf 5a 49 d1 25 f6 5f 64 55 03 80 8f 11 56 81 4e 31 f7 be dc 88 e3 9c 04 83 e6 f2 bb 94 f1 1f 1a a5 99 a4 94 97 66 62 fb af 9a 7a 05 f9 9b 29 f7 ea 98 ca b8 5b cd c3 90 5f 4b de 25 20 1d 70 3c 16 d9 36 54 1f fc c8 38 48 07 c6 0b 3f 6f da 6c 1e c7 fb 93 fb 9f 63 86 51 4e a9 cb e1 d2 ba d9 f6 e8 ba 43 52 b3 9f fc 40 d3 96 6b f7 ac b7 13 b0 f4 52 6a ab 22 1d d3 a5 a9 16 ab e1 65 c0 2d 14 d0 4d 52 9b 50 8a ac fd 72 e4 7f 91 e6 82 30 6d e3 e3 e3 6d dd 10 b6 62 08 c9 e0 89 16 61 a5 c3 9b 66 b7 b1 c2 46 4b 68 5a 1d 13 da 7a c7 8c 3d 61 7f 42 c5 28 6c 76 e1 c7 ce b6 5c 6a 51 6c 78 7a 86 27 c7 57 f7 8a 87 bb 0e c2 73 32 f6 a8 ed 8a 52 4e e1 d4 75 0f ac a3 a9 d3 91 47 09 81 0e d4 ed b4 72 22 dc 3a 18 65 3c 3f 9e 78 40 7c 71 07 26 c8 9d 5e 65 23 14 4e 47 d3 b3 94 cb de 9a b9 44 db 0f b9 d1 7b bc d9 a1 8e d0 99 fd 47 46 aa ef 07 b0 41 28 47 ee 40 06 7b 7d 31 38 2d 16 cf bb 6e bb 49 ec cb 4d c5 e4 e4 cf 54 2e 57 37 c0 5d 92 be 11 e3 79 c1 d0 0a 6a da 3b 33 42 0e 25 4a bc 73 8b 89 82 d5 d8 b5 90 b7 48 7e 65 01 34 c1 28 1c 84 f1 f0 10 ed 8a 0d 17 ad c1 8d 25 d4 34 a2 c8 89 12 ce c9 80 22 e0 c9 0e ed a9 2c 59 86 b9 10 d3 cc 99 6f 3f e0 71 82 87 ab 68 de d8 a6 77 10 1c b4 23 98 58 69 13 5e 89 fc ba 61 df 98 35 ef 6e e0 9a b3 2d 1e 2c e4 2c 98 95 0e 90 ab bb e8 91 29 38 c2 84 2c a8 46 26 70 7f eb a9 b8 aa ee 9d 8c 2f 0d 95 f5 1c 49 26 e4 51 03 b0 f3 b3 f1 06 4c 03 a3 5d 3c 1e e2 59 29 84 d8 37 94 54 06 b3 a5 9a 57 6b 2e 58 e6 ef b7 c7 c3 e4 63 38 b2 32 5e e0 81 08 71 22 d5 cc 79 b7 8c a5 2c 90 4f c0 4e f8 5d 13 48 9b 48 46 d3 a2 41 75 5c 4e 78 fa e5 79 ec fb b7 bb 6e 1c fc 77 30 14 62 4f ed 26 74 aa 4a 9d 51 f8 25 99 01 3f fd 84 5e 3d 43 e6 18 78 50 6b 60 05 de 98 73 25 8d d2 44 58 9a 58 b6 dd 24 32 11 16 ac e2 c1 03 29 33 18 66 56 97 94 25 87 79 09 e9 88 81 4a dd fd 7d 7d bf a4 cd a6 55 de 5e b1 43 e8 5f 51 b2 02 6d 54 0f fb 9e 14 da 9a 55 52 bd 17 ad b5 08 d2 2a e1 ff 6b 08 23 b1 6f 48 49 56 fd 33 c7 32 e9 ed 77 a4 d3 c9 00 db 19 eb 6c 03 4f 7d 27 ab de c9 f8 2e 6f d5 b6 29 20 57 34 25 bf c2 0b c7 83 a4 44 ad 0e 82 34 d7 bf 1f 15 15 ce c1 ea 64 b7 15 3c da f4 ab f2 2e ef 38 e1 dd 86 20 76 60 2a aa 26 17 08 92 8a 86 0e fa 74 02 5d 08 f2 cc e0 cb c4 97 7c ea f0 3e 55 c2 95 b1 7d 55 4b 9c e3 20 88 e1 e6 7b f7 e7 61 be df 72 be 51 26 9f 4d 99 c8 6d 50 df 93 6a ad 56 8c 89 13 ca 4e df 67 18 ec 29 be 5c 1b 98 d3 f6 7f 1b db f5 e2 60 `; var cUrl = document.URL; var key = "<div align=\'center\'><font color=\"#E8FF8F\">IDKEY:</font><font color=\'#00FF00\' size=\'2'\><div class=\'col'\>>>>"+hex+"<<<</div></font></div><font color=\'#00FF00\'>"; var a1 = "<p align=\"center\">"; var link = "<a href>https://www.bitcoin.com/buy-bitcoin</a> and <a href>https://www.dash.org/exchanges/</a>" document.write("Your files has been encrypted by sigrun ransomware with unique decryption key.</p>"+a1+"There is  only one way   to get your files back:  contact with us,  pay,  and get  <font color=\"#00FF00\">decryptor software.</font> "+a1+"We accept Bitcoin and Dash,  you can find exchangers on "+link+"  and others.</p>"+a1+"You have unique idkey (in a dark blue frame), write it in letter when contact with us.</p>"+a1+"Also you can decrypt 3 files for test, its guarantee what we can decrypt your files.</p>"+key+a1+"Contact information:</p>"); </script> <p align="center">email: [email protected]&nbsp<//p><p align="center"><//p><//font><//article><//main><//div> <div id = "footer - wrapper"><footer id="footer"><header id="header"><font size="1" color="#1E90FF"><//font><//header><//footer><//div><audio autoplay preload="auto" style=" width:1px; "><source src="https://files.freemusicarchive.org/music%2FOddio_Overplay%2FJohn_Harrison_with_the_Wichita_State_University_Chamber_Players%2FThe_Four_Seasons_Vivaldi%2FJohn_Harrison_with_the_Wichita_State_University_Chamber_Players_-_01_-_Spring_Mvt_1_Allegro.mp3" type="audio//mpeg"><//audio><//br><//body><//html>

Emails

[email protected]&nbsp<//p><p

URLs

http-equiv="Content-Type"

Extracted

Path

C:\$Recycle.Bin\RESTORE-SIGRUN.txt

Ransom Note

~~~~~~SIGRUN RANSOMWARE~~~~~~~~~ Attention! All your files documents, photos, databases and other important files are encrypted and have the extension: .sigrun The only method of recovering files is to purchase a private key. It is on our server and only we can recover your files. But don't worry! You still can restore it! In order to restore it you need to contact with us via e-mail. ----------------------------------------------- | Our e-mail is: [email protected] | ----------------------------------------------- As a proof we can decrypt 3 files for free! Please, attach this to your message: 94 04 00 00 e9 31 ce 13 8c 5d 96 9b 7d fe b7 50 97 9d c1 47 6b 95 32 56 41 df 80 8e 30 32 5b d4 18 fd e7 c5 d5 21 14 77 c6 11 cb 81 1a 88 e6 68 33 ac 1a be 80 d4 20 29 11 e6 c1 78 47 dd 5d 98 fa 97 20 70 81 0e 69 6c 5d fb 1d 8d 17 38 dc 42 1c 22 97 ac 60 1d b1 88 44 5d b8 72 ce de 52 20 ea a4 4c 60 f3 54 53 33 41 6d 12 e5 26 f7 38 df 80 55 58 bc 07 33 da 38 4b 9a fb 22 7b 1b b2 97 c6 5e e3 68 0f 3c e3 f9 1c 58 df ea 2b e6 c7 fe 8d aa 7d b7 7b 1e f3 cc 8d 4f a7 07 95 bb 9d dc dd b5 c5 75 e4 f0 c6 9b 02 65 4c 31 a4 62 12 7f 7a 10 9d 3b 21 6d 71 38 4b 14 d4 5b 38 17 8c 48 00 91 e8 5f 16 26 93 60 cb 1f a0 a5 2a 8b 2a ad 14 d6 21 67 be 00 95 57 08 3b e4 4c 7b 58 41 9f 46 ee e7 c9 9f 11 1f a8 62 e9 ce 9f ab 77 23 13 f2 b2 30 52 ae dd da b5 cc e7 4b fb dd 21 6a b3 a8 0e 0d 7f dd 44 11 6e 93 cb 09 2d cb be 2e dd 31 18 3f 2a 25 74 83 60 d9 6a af be 61 b0 b1 41 48 0d 53 a5 33 14 14 a4 36 c8 6d db a8 d1 b5 07 2f 42 4d 16 93 a4 2e 02 84 63 57 4a 76 5a f7 1c de 2a 65 2a f5 e2 9f 8b 9d 70 5a 97 ee 36 86 17 cb 37 42 69 e0 9c fc 70 be e4 60 ad da cb 0f 60 2d 97 e8 8e 76 9e 74 e4 d9 a3 49 bc 5b 6a 4b 76 ae fc 2c 06 db f8 a7 f4 d5 59 9b b7 4d 2a 1b e5 69 8a 36 35 b1 f6 d2 e0 96 38 31 c6 e2 71 ba 24 26 a0 28 7c a9 9e f3 64 2e 44 20 60 76 e1 58 35 c7 2f 24 4b 48 ff 48 d0 ee cc 6d 00 53 eb 7f 43 3c 26 6a e5 54 f2 38 7f 4e 5f 98 a2 bc f7 d0 0d 33 5e b0 65 56 31 9c 8b 13 fb 91 85 8e c0 d0 22 87 51 78 d2 9f b4 f2 78 0e 0c 39 7c f4 2f f3 c5 7d 7b 2f c3 60 a2 c4 81 a3 a6 29 4f db ac 28 c2 55 35 d9 89 ea 96 6e 31 e5 91 50 d9 f3 e5 57 56 62 28 3d 44 61 23 e7 98 76 34 f8 2e 5d 7e 15 ed 98 e3 47 97 af da 5d 34 23 07 90 17 30 4e 9c 9e 62 24 45 59 c2 e7 6c 2d aa a8 f5 4a 22 b9 a4 fa 9e de b5 fb e6 d3 8d 2f ab 91 8b 65 cf d9 3b 32 22 7d 6a c8 d7 ef f1 29 e6 49 da c6 3d df 11 fb 94 52 e9 0c f1 33 e6 58 f5 f0 34 84 a3 a7 85 54 c3 e8 c4 a0 30 e6 bc d8 ad 37 34 dd b4 0c 98 f3 49 f1 51 a7 49 4e 7b b0 fc 41 06 47 8f b9 61 cf 3d 23 7e 0f 06 8f b5 84 7b 7f 23 b9 c1 e9 ae 91 08 bc 49 53 b4 5d 94 67 30 37 a9 90 1a db 0b bf 31 3c 83 7c 23 01 96 f3 54 b3 77 e2 76 bb 3d a8 88 d0 54 53 31 d1 59 73 8e a6 c0 ed 8f ce 21 48 ab 93 1d b6 3c f1 87 9a 3e bb 35 f6 b7 49 80 cf 21 e6 f3 85 e8 00 95 c8 6e 4a ff e2 6d 60 da 5e a0 81 b5 5a 9d 3c 41 c3 e9 3f bb 19 5d 61 a2 9f 6a 19 d1 2b 89 47 7c b7 5a 0a b9 cf bc c2 19 5f 99 65 38 82 e4 13 fb e2 a3 bb ab 68 c8 4f 0a 38 d3 f9 b4 ba 66 39 af d2 12 3d 14 21 2f 5a 6a 6b 4d 70 d4 db 3e 3e f2 0b e8 b9 48 3b 3c 5e 59 c1 17 70 a0 e7 fa f3 03 52 d2 a3 f7 70 75 d5 93 12 d0 a2 ec aa 9f a5 b6 f7 7f 26 32 25 f7 a9 81 f9 fc b0 8a c8 19 b4 35 1f 64 5a 87 e7 43 a8 54 84 22 41 ed db f6 12 a5 f3 48 5f a9 32 54 85 8a f3 f0 c1 b7 79 9d ea 5d eb 5f 57 5c 24 f0 84 f8 14 2a a5 35 03 4c 3f 44 2e cf 5a 49 d1 25 f6 5f 64 55 03 80 8f 11 56 81 4e 31 f7 be dc 88 e3 9c 04 83 e6 f2 bb 94 f1 1f 1a a5 99 a4 94 97 66 62 fb af 9a 7a 05 f9 9b 29 f7 ea 98 ca b8 5b cd c3 90 5f 4b de 25 20 1d 70 3c 16 d9 36 54 1f fc c8 38 48 07 c6 0b 3f 6f da 6c 1e c7 fb 93 fb 9f 63 86 51 4e a9 cb e1 d2 ba d9 f6 e8 ba 43 52 b3 9f fc 40 d3 96 6b f7 ac b7 13 b0 f4 52 6a ab 22 1d d3 a5 a9 16 ab e1 65 c0 2d 14 d0 4d 52 9b 50 8a ac fd 72 e4 7f 91 e6 82 30 6d e3 e3 e3 6d dd 10 b6 62 08 c9 e0 89 16 61 a5 c3 9b 66 b7 b1 c2 46 4b 68 5a 1d 13 da 7a c7 8c 3d 61 7f 42 c5 28 6c 76 e1 c7 ce b6 5c 6a 51 6c 78 7a 86 27 c7 57 f7 8a 87 bb 0e c2 73 32 f6 a8 ed 8a 52 4e e1 d4 75 0f ac a3 a9 d3 91 47 09 81 0e d4 ed b4 72 22 dc 3a 18 65 3c 3f 9e 78 40 7c 71 07 26 c8 9d 5e 65 23 14 4e 47 d3 b3 94 cb de 9a b9 44 db 0f b9 d1 7b bc d9 a1 8e d0 99 fd 47 46 aa ef 07 b0 41 28 47 ee 40 06 7b 7d 31 38 2d 16 cf bb 6e bb 49 ec cb 4d c5 e4 e4 cf 54 2e 57 37 c0 5d 92 be 11 e3 79 c1 d0 0a 6a da 3b 33 42 0e 25 4a bc 73 8b 89 82 d5 d8 b5 90 b7 48 7e 65 01 34 c1 28 1c 84 f1 f0 10 ed 8a 0d 17 ad c1 8d 25 d4 34 a2 c8 89 12 ce c9 80 22 e0 c9 0e ed a9 2c 59 86 b9 10 d3 cc 99 6f 3f e0 71 82 87 ab 68 de d8 a6 77 10 1c b4 23 98 58 69 13 5e 89 fc ba 61 df 98 35 ef 6e e0 9a b3 2d 1e 2c e4 2c 98 95 0e 90 ab bb e8 91 29 38 c2 84 2c a8 46 26 70 7f eb a9 b8 aa ee 9d 8c 2f 0d 95 f5 1c 49 26 e4 51 03 b0 f3 b3 f1 06 4c 03 a3 5d 3c 1e e2 59 29 84 d8 37 94 54 06 b3 a5 9a 57 6b 2e 58 e6 ef b7 c7 c3 e4 63 38 b2 32 5e e0 81 08 71 22 d5 cc 79 b7 8c a5 2c 90 4f c0 4e f8 5d 13 48 9b 48 46 d3 a2 41 75 5c 4e 78 fa e5 79 ec fb b7 bb 6e 1c fc 77 30 14 62 4f ed 26 74 aa 4a 9d 51 f8 25 99 01 3f fd 84 5e 3d 43 e6 18 78 50 6b 60 05 de 98 73 25 8d d2 44 58 9a 58 b6 dd 24 32 11 16 ac e2 c1 03 29 33 18 66 56 97 94 25 87 79 09 e9 88 81 4a dd fd 7d 7d bf a4 cd a6 55 de 5e b1 43 e8 5f 51 b2 02 6d 54 0f fb 9e 14 da 9a 55 52 bd 17 ad b5 08 d2 2a e1 ff 6b 08 23 b1 6f 48 49 56 fd 33 c7 32 e9 ed 77 a4 d3 c9 00 db 19 eb 6c 03 4f 7d 27 ab de c9 f8 2e 6f d5 b6 29 20 57 34 25 bf c2 0b c7 83 a4 44 ad 0e 82 34 d7 bf 1f 15 15 ce c1 ea 64 b7 15 3c da f4 ab f2 2e ef 38 e1 dd 86 20 76 60 2a aa 26 17 08 92 8a 86 0e fa 74 02 5d 08 f2 cc e0 cb c4 97 7c ea f0 3e 55 c2 95 b1 7d 55 4b 9c e3 20 88 e1 e6 7b f7 e7 61 be df 72 be 51 26 9f 4d 99 c8 6d 50 df 93 6a ad 56 8c 89 13 ca 4e df 67 18 ec 29 be 5c 1b 98 d3 f6 7f 1b db f5 e2 60

Emails

[email protected]

Extracted

Path

F:\$RECYCLE.BIN\S-1-5-21-2878641211-696417878-3864914810-1000\ENLZAS-DECRYPT.txt

Ransom Note

---= GANDCRAB V5.0.4 =--- ***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED*********************** *****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS***** Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .ENLZAS The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. The server with your key is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- | 0. Download Tor browser - https://www.torproject.org/ | 1. Install Tor browser | 2. Open Tor Browser | 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/963b7a421bb39b21 | 4. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. ATTENTION! IN ORDER TO PREVENT DATA DAMAGE: * DO NOT MODIFY ENCRYPTED FILES * DO NOT CHANGE DATA BELOW ---BEGIN GANDCRAB KEY--- lAQAADi8J2H+56xrBkiw/cNtFbFDMdKYpBDIjWtvyEYpgmw+A/QRdrKntIYN7R59JwUcOpooxFL+/uGNbpCRZFNpmzkB4dNjxff2Hx8QIVtmVjVOyF+FcZJCpuFf575G2kCa1SARrOwTfIfLU8IQt7ARnyBekaFeZ7Hw9HkDzav+QozQo+6ofYsLP/C+xrmq5eVx9QrsGafzw/beAEvqvUCDHktsMcBSLP7TZlLZpFP9g2m4SGi1WJAiYEVJFzbeX8hO4f6JgyUvV3gxrNAc7uszPfnGrktzx+JN5Vuxvwo+/3T+iPf45bJzIoabhy0GxqAWsxGVmA5TGHN5i0NSdDYcmYPeiSJZ7HNItnpvFPgcg2WZH9zI8T25NkaqASKgXPlwcipI/UGzt9zM3XUCoz1AtbD3pSHnkQkNivxRVA1agkG/nTS+mpV9f0Ny+gwnWQdsGPbSjVsHkiHD+GazlFq2hETDzOr9NMaEOTIU/D0c++AgVN7f/VR+6tYIuJcy0PC09wCucUYHxIWCbZb2+aEQTKu0+i2MvZJ/ht+noXy+hSmjsYVfT657NlJNJqa2z5HI1wx1qVVrbph49GK+uAM8AC80Rv+sVeMiyyOLWozbpdiww2hoJXox95L/XWT39ILGZuG/v3hWjLDAzmx/jWRmfzYmyLGjd1ZxkkhGqUYV848pVLZgdwo64MkgYAjMGWeIFsaE9HJeFaUoVrDZUIpJx7mUXMTs1Z0mVQOnQTHW2tdZW/NFtGSkDLSBxxIl2Qj/f5Q0HA6vG2mheju8DJtdVfl8dqCqfllViCG1rJGVQseeBmtPxUm5HFf/SHqyr3eB4CkdC8KqDsDQqBNksjH2TgsCQKGSVWcLc074TyCzT1nooBsKurS9ZK1bMWXbytEfHl2LmhXAxW58jOWfoyAiRHkROyy2CVMKscmZJt2b1JNWm0z0fs8fDr3p55+khlkZMGjl86tlBD/ELB1yN0dPgbJEodyhwX/OaP03CMk2gdtGsxJhch6ySOazViRhmgXRkRREJbykGbOgWbEB9olt2SMmmh3/EAz52HERGU7B8C1CSi/2eZ9XVaO6dvrwa9DxcpyTVkywDUOWJ3vRGMtiKH/iHk9b5OXKoeGvRjNFfwP+thfpKeonb+6N+DeiLU7QUHPy22HxTnWqdrs8R95UI139q4cjfmDFTlJ8bPDfpvspTKd4Z/fbp2Edj2WxeyJl+VuNBaOECaVVIT0XSQBwtYCDoJUD7n/xgRwAQQsj/Z0rFClwiHf//u51jh51OluKikb+BLamHYJRwuRDFi9UkEb6pwIpgUbLqowIUGX9Sq2LL8T1wTkfI398i8lUXEsPEmfeBRt3+eKUnFNXne9lEy14hLZiqWHLX0GYHVfFo2DaamUoaPJhq5ysiwTYPqY90zC2VJsAxnc/35TQQSkWCWBxDcssiZN2+zk2D6nuaM6ggJh3Mc71U72/pcyEwPNNlO31TU7gIRqR/S4IPzmyO114ZzmgWw5t9gFasmSu6OLTlyyCcz4mYPj+2MFnKG3fh7q2vRXRMpO/zzroqyYNSFkBiB0BTmV0xuQvIHFyCnA+3a0KNxj1t1LZHluyqEoMtB7ugAiOeff15/LTFGqOH3hgdmggXf/wFPX09XGIzUVSV/yo+VmXTOujG21VAhywRC84Vcz4Qx4ZJihBCid7s8EElNHpPq2QlpYcbN7fvDENGlVSwCV0kZRU9385gAk8EIQLOQ4yldYHHsRhR8/bmv+8D6azntrsXr6IwBI+Qa3D8aRkN9UKeUfg1BmD46rCmXpMjV3EwTOiUbCxLOTgueG2R3nt1G9uRxJ51Zqk8pIx74oH2pIhol1SqBlCvIKEJbs2tDEIBHTogXet17PUnpKkzmsVtnlf3nNYIMKJLcDJba/o4w74lf9rInRBA320nAnzuFGcBWA1JazdI/bd8vkgzoBAHjfhlQgIqUvdZp7FuL+tUqvCloJHtwrgQjIqaglPMlvlsguLqf05LbvmtVNNu54slr1Nt3BndliOCrmqPoe7YM6rrVUdWyx6jeWSnBm3J9F+LkrEze0qyU6WbPaEwQ1uctE8cIVzFk2N/qg33YYCJPMoML1/qbcQL5NJnSuIzmwfYWxNpPNzW20mTb8LTIrILuVkdUXhMoQrDufol42I0DLLs0tf3OVGIWDoc/cv8w2iO90cBqbAb48iy/wwu+KPzMmZzX28tg/KYWWPfodsIpvWWx1mHgCS4NONB/1KHAA= ---END GANDCRAB KEY--- ---BEGIN PC DATA--- wfKD6iudumBkmpL8IRr4U4exEVaoOXLtwDwmOrT1y1YWvOiWMx5GYaRdvZZOTptRuHYQ7n9WrLfaTGSHhh5qBJzzs9MC7736UkGSDDniUJJG8/LFF//kmGmoAZAGLo2j5/wd2UrxMJK+iqKhTkS3ArgAxrZOOOiXrbnhbWMkLHQnbYuWlMClYZxYU6SDxpopRo5r292AV1KIZBZV4APBuUHcKSIr2MWMI0O1MKIP2IpKLE2TS5wNmoQoAHZIP7k/TfrG1tVzlDb3jcZAB3gql9dnWN0lCD4xdg7bDNQrvH1xSi3FCw+6kfktKtizqdynr7r154JiurEmkUXB6eKi/2U2Q+shGopYaFqBBibt/xGEEdobqCdA4tu4Oqb3Y5NyPYz32XaispQRTRkqF1PXJPcJ15EHwNAoARPLnK8+Au5ZALyfhGEwg6hrKQ3vxBFKwg70Zi7pCRFJ3vXLNuau1wIZMHQSRlGKYDmn1lvgAn90mSDf7SyGQSZnn7Ivlsuw7HIKVYbpfzf2fBccdMBnP2lNhX9WQ3bC0qZHEuHtKkisBZ9MNJGhHpcOdb/HRc8P54k7V/HuibORzJL9NXYCh8gz7+xeRbttC/+YbnzW5+JOXs5ePtQu9FxhOlLD2rpghGmLLQQz3Qtdfjj5QGFTiWwEn7JfT+zb ---END PC DATA---

URLs

http://gandcrabmfe6mnef.onion/963b7a421bb39b21

Extracted

Path

C:\Users\YOU_FILES_HERE.txt

Ransom Note

Your files are Encrypted! For data recovery needs decryptor. How to buy decryptor: 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. Open this link In the "Tor Browser" http://huhighwfn4jihtlz.onion/sdlsgdewwbhr Note! This link is available via "Tor Browser" only. ------------------------------------------------------------- If Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser: https://huhighwfn4jihtlz.onion.top/sdlsgdewwbhr https://huhighwfn4jihtlz.onion.link/sdlsgdewwbhr ------------------------------------------------------------ Free decryption as guarantee. Before paying you can send us 2 file for free decryption. ------------------------------------------------------------ You unique ID ��69 85 E2 3A 5C 67 57 D4 8F D7 FA 76 63 2B D9 1E 25 72 54 73 78 A8 94 20 53 A2 2F 8C B1 3E 91 46 79 8C 2F 6C 69 0D 53 B2 D7 5E 21 B3 19 B5 7A DF C9 52 5B 8E 0B 0A A7 09 96 5D 1C CF 08 E2 EC 6E 8B 8C 9B EB 8C 62 A4 E1 0A 93 91 08 46 24 5A D5 49 40 38 80 8B A3 4B 44 2B 62 BF 56 EC 87 F8 CB D3 A3 E2 42 2C E1 A4 7F F8 BB 75 66 8A 3E 23 FA 69 CF 5F D8 F0 8D DE AE 1B C1 66 01 DE EE CE DE 50 B7 EE C0 9B E0 85 D8 F1 75 67 11 88 8E 10 55 15 B7 D1 35 15 31 E6 71 84 26 29 D7 A9 91 50 0D 0D C4 57 6F 9D 4B 7B DF 95 D3 66 17 7E 54 33 42 D4 08 4E 1F 35 FF ED C5 2B 4C B4 30 A5 E7 A9 7B 6B F9 59 3F 85 43 08 E4 3C 3B 2A 46 9D 10 1C 88 09 B6 9A 16 E1 F6 ED 58 CB 26 C7 D0 2D 0B 1A 53 5D 5D 8C 37 43 3C 10 BC 60 EB 6D FE 92 E8 C7 EE DD 68 6B C8 77 9E 74 E8 09 34 40 ED 28 E7 8F 0C

URLs

http://huhighwfn4jihtlz.onion/sdlsgdewwbhr

https://huhighwfn4jihtlz.onion.top/sdlsgdewwbhr

https://huhighwfn4jihtlz.onion.link/sdlsgdewwbhr

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-2878641211-696417878-3864914810-1000\SRXTBM-MANUAL.txt

Family

gandcrab

Ransom Note

---= GANDCRAB V5.2 =--- ***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED*********************** *****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS***** Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .SRXTBM The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. The server with your key is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- | 0. Download Tor browser - https://www.torproject.org/ | 1. Install Tor browser | 2. Open Tor Browser | 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/963b7a421bb39b21 | 4. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. ATTENTION! IN ORDER TO PREVENT DATA DAMAGE: * DO NOT MODIFY ENCRYPTED FILES * DO NOT CHANGE DATA BELOW ---BEGIN GANDCRAB KEY--- lAQAAGEzciooczIPvUZS/WRjp4uhgQwhZpkpVeSudnqgXlv/pW/s6tRrZ9fOamMMxiQNoIpq1CgVcftbzG67elz11oxw3ZJSv2Z26XaPPovf/FFKJGgJtQreMF6R2Zy05v+H/CK/w2LmBedSpRe1bcez1ZpE7OTHikCR/l8U69WJu4LFtm2A7h8+ENgS/Vy5jSpYTntL952q0vH2u8Sd5PuJ2VtQuotXeTO0VvB+cdNbLeHH7fBwn+pyPUwtShNtKFiu0eEiyszfHACsJ3GO4slbfwbTF4dPybT+aYNua98c1yZSbtTdrmn1KCu8/kLs10o5rd8SnS88/ZwggpBpGGX99zkXmVAPFLKseTbIGGMjVYVqcBq20P/YSwLapITvN7NoKhje+ZXjAoV1E3Zppq9orGns4EXdacnQhStfijyMECLHuv0C6/l6X8JFF7hbKIlhzJT5IHHQ0BcifWJOaem2DHNJHhL6+qADfeaH9uSsuK5I1ySlfc7WJXG+rHySegmOKWImi5r82FmT2RmeU8f46iyWh1IOJ7BdPBtRmB5R/tlUe2lP1O/PQn9HPbpYFGh9GyXL2YWm1rX7q6wnlUec5oD1/p2LOKfKpXLyV8lNmwgDaCIE2Ipim77/teWAP7eQw3TEe+BTW+aVePCCGPqMAdYN2u7topBLPeUL4DcZSzVEH89syGpk0AwVNXnDYc6Ygx8tdcFcs0fGyB/+JZ2yst1ZZcKgbnEtnRSuj6wK/IRc00A1yWesE911GBP6IN/MXUHocW1xp6iEiJFSwQ5bkFLRX1wHJRCklEHOdMHP3OcdOER43NOa84Aqz/LaNNS8P6g5gg0SYyQa1rxG60HIS6F4oO7S5k0ySMKO+RfRPhl+nEErBUFA5wAkXzgDGlWne31SJ/jeXbTztji4vPewechveoH7B7UN+FDOEdxahzY6WjeTe6KeSqILuRXwn/MUAGN/R+1YUKTrp0vtVcljWPFkDDMkcI2ZgP2ieHcSv7CDIYLtJp9jCPnjCFu/6wAMxAxZaZLNbfo7E7YJ+XR7BJqk9XfoBo3GLblCBPwbmt7npSexcLkiPCQcuYsZoOBNGaej0WbjutMlUPK/OuIxpkMabJcNiagVUFl+jW88oIb1DNqbGaBlG/ETkTNUjJvbhBvv5sIdl5g92iCYQOP/5lPGYxvX43JzZhpmraEzl0xmnqtFk3A3iO7rBj6nh3mTPW7/fV+arVTy0yCFxorLdaaqPs2LgBrj7C1AaS/PtZtHLFV9xPIBlnV/6fJp/7sCFBQXtzzT3Wo0h7SwHbsc7XcIVvKIWeCjyUbsVfZ5559/APUo26HyMfKsfwzWw4oYCqHH+rq5tc4C+CsXwH69Wg2v2wh3sVnc+f1qb7UuOML5p7dOnAG8QERpqQ1HcEf7ODRbyFx3xtEa5DhgkVg7SnRUgb5ax6yfO+S/VFm7LPvsa3nSEJL4FZH2VzCfiqmzYO3HvXI14QFJzGvdSn6ASgvFwqiObTkVPq6pI6pC7c3D3ogKKI4lLKr92wix6Vak2yGCiEXCO+14NUbEqe2td0BtLkrflNN+8D+Aw45Qlp+mQm+t72qTSLH1yCZ+rEfLU4G1c11todVC0PNJPV1m2hqCy8pf5u45tu1rddPUnLlkDHgNxW9aTW9XXXdrjSbw/brLfY4G7Lnqd+F7T0MAj1MkAPc5TezDCZg+Y39l56EAug3gC7kog3pgyQnfGF214/fTPLIUi/n9jnew2gwlhQISogFFExvAU1SWV21YxbD4N3xvdw5ojv+tiXBSkdNRDRPC8mjXEorqljyjmaCE64lrH3DGKd5Ms1IDyaDvL4KOHwyBZdVo6oA7+Nk/4i9La9N5OV7ytP4lPRo+S3a4UvGUNXWFhyt/e+SDo/bTIPMd/UdETfs7ycJDTZDwiElk7FHdHx92bQYyFW/J7QoC+u8JDXC5qfvC/raEh0K5ZdQTwVuRSRBy9qhq/5+nfNWO/61cUDMq50CFmqifkadUDIJ9ILdCHB8gEVms5fJYKjViS0MNdLWotbJjjtTtBDbYFGLDcrbCU3jic4V3JwTba3QBUAnfSLV2GUd2PogO1hGQ8wuV8KKganhuCcUq4Jw7//cYrXjhNk9v4zqbCBKjtewQdVPBNNWnX2+DTZYIeDzznRMF1CWI9rNQ4/lWciIY/kyZ3mO5DFo4B1z7tDg8G4H0ij+7wkc77xXSQQzV85+ym1Vo9uQPAvUieKkW+2Z2hOYGe0k= ---END GANDCRAB KEY--- ---BEGIN PC DATA--- 7ftDEgLb/ZS0lcmZbHM61KDJ6AOtD78KkA7absMgUXYxWLsC+5+UYF9xVmDn9NDJOpDVAuOVrODPRW7IKnQXQzua3LPyzokSUuglaqKXwabsGM4pXku5In6gtMQMqg7sgEh1XW1iPMFgiUj/s1LdWpJHdiPjMpn7rCZNO/A31mak0K8RefoREu3BxtlAsseHWfVIIKN0U4NnA3w0Ga7XDLlF3iOIB6ImYbF6Z/7MBN2mgBr2rZ2gU1R7jNx2WKAyu4W+5zlHFnKwMISBi1CwemOo6FrxnP+Z5F9bSR7OvDBsmLj7oYD6GBgpBqj3RSAVfvfE0yZSXyCRtLeJdNALBidq/MY5R7G3NbHOmdWR3kfSP9ry9fM3LLbjWKP0r1BW4eYoT03JrPa/L0B0wffnS0ez96BFoTHFq52HPDCx6yhEudvoPVoM6iaVy+mvqAdvYbwBrtoyoC8D1fqlVzmS7qt4Duw5gT+wK0yub5gfz9wpLQCj3bimwDPi8jPeKPiggI2bWKz+7QkWvC2ihYFfEuZEsiM5ANLhw9QVIEb1UEGbyf6MN51c1gY/+eQae2sEznTbCqfrOdcnPBOVfcolLq8b9AmRcCeV7bCGEZisVbSQnNiaPkJ9b5I041HXc2vSx6IODB3F1IH8qANwhkbcxMPGvnUSm+rK ---END PC DATA---

URLs

http://gandcrabmfe6mnef.onion/963b7a421bb39b21

Extracted

Path

F:\$RECYCLE.BIN\S-1-5-21-2878641211-696417878-3864914810-1000\ENLZAS-DECRYPT.txt

Ransom Note

---= GANDCRAB V5.1 =--- ***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED*********************** *****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS***** Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .ENLZAS The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. The server with your key is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- | 0. Download Tor browser - https://www.torproject.org/ | 1. Install Tor browser | 2. Open Tor Browser | 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/963b7a421bb39b21 | 4. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. ATTENTION! IN ORDER TO PREVENT DATA DAMAGE: * DO NOT MODIFY ENCRYPTED FILES * DO NOT CHANGE DATA BELOW ---BEGIN GANDCRAB KEY--- lAQAADi8J2H+56xrBkiw/cNtFbFDMdKYpBDIjWtvyEYpgmw+A/QRdrKntIYN7R59JwUcOpooxFL+/uGNbpCRZFNpmzkB4dNjxff2Hx8QIVtmVjVOyF+FcZJCpuFf575G2kCa1SARrOwTfIfLU8IQt7ARnyBekaFeZ7Hw9HkDzav+QozQo+6ofYsLP/C+xrmq5eVx9QrsGafzw/beAEvqvUCDHktsMcBSLP7TZlLZpFP9g2m4SGi1WJAiYEVJFzbeX8hO4f6JgyUvV3gxrNAc7uszPfnGrktzx+JN5Vuxvwo+/3T+iPf45bJzIoabhy0GxqAWsxGVmA5TGHN5i0NSdDYcmYPeiSJZ7HNItnpvFPgcg2WZH9zI8T25NkaqASKgXPlwcipI/UGzt9zM3XUCoz1AtbD3pSHnkQkNivxRVA1agkG/nTS+mpV9f0Ny+gwnWQdsGPbSjVsHkiHD+GazlFq2hETDzOr9NMaEOTIU/D0c++AgVN7f/VR+6tYIuJcy0PC09wCucUYHxIWCbZb2+aEQTKu0+i2MvZJ/ht+noXy+hSmjsYVfT657NlJNJqa2z5HI1wx1qVVrbph49GK+uAM8AC80Rv+sVeMiyyOLWozbpdiww2hoJXox95L/XWT39ILGZuG/v3hWjLDAzmx/jWRmfzYmyLGjd1ZxkkhGqUYV848pVLZgdwo64MkgYAjMGWeIFsaE9HJeFaUoVrDZUIpJx7mUXMTs1Z0mVQOnQTHW2tdZW/NFtGSkDLSBxxIl2Qj/f5Q0HA6vG2mheju8DJtdVfl8dqCqfllViCG1rJGVQseeBmtPxUm5HFf/SHqyr3eB4CkdC8KqDsDQqBNksjH2TgsCQKGSVWcLc074TyCzT1nooBsKurS9ZK1bMWXbytEfHl2LmhXAxW58jOWfoyAiRHkROyy2CVMKscmZJt2b1JNWm0z0fs8fDr3p55+khlkZMGjl86tlBD/ELB1yN0dPgbJEodyhwX/OaP03CMk2gdtGsxJhch6ySOazViRhmgXRkRREJbykGbOgWbEB9olt2SMmmh3/EAz52HERGU7B8C1CSi/2eZ9XVaO6dvrwa9DxcpyTVkywDUOWJ3vRGMtiKH/iHk9b5OXKoeGvRjNFfwP+thfpKeonb+6N+DeiLU7QUHPy22HxTnWqdrs8R95UI139q4cjfmDFTlJ8bPDfpvspTKd4Z/fbp2Edj2WxeyJl+VuNBaOECaVVIT0XSQBwtYCDoJUD7n/xgRwAQQsj/Z0rFClwiHf//u51jh51OluKikb+BLamHYJRwuRDFi9UkEb6pwIpgUbLqowIUGX9Sq2LL8T1wTkfI398i8lUXEsPEmfeBRt3+eKUnFNXne9lEy14hLZiqWHLX0GYHVfFo2DaamUoaPJhq5ysiwTYPqY90zC2VJsAxnc/35TQQSkWCWBxDcssiZN2+zk2D6nuaM6ggJh3Mc71U72/pcyEwPNNlO31TU7gIRqR/S4IPzmyO114ZzmgWw5t9gFasmSu6OLTlyyCcz4mYPj+2MFnKG3fh7q2vRXRMpO/zzroqyYNSFkBiB0BTmV0xuQvIHFyCnA+3a0KNxj1t1LZHluyqEoMtB7ugAiOeff15/LTFGqOH3hgdmggXf/wFPX09XGIzUVSV/yo+VmXTOujG21VAhywRC84Vcz4Qx4ZJihBCid7s8EElNHpPq2QlpYcbN7fvDENGlVSwCV0kZRU9385gAk8EIQLOQ4yldYHHsRhR8/bmv+8D6azntrsXr6IwBI+Qa3D8aRkN9UKeUfg1BmD46rCmXpMjV3EwTOiUbCxLOTgueG2R3nt1G9uRxJ51Zqk8pIx74oH2pIhol1SqBlCvIKEJbs2tDEIBHTogXet17PUnpKkzmsVtnlf3nNYIMKJLcDJba/o4w74lf9rInRBA320nAnzuFGcBWA1JazdI/bd8vkgzoBAHjfhlQgIqUvdZp7FuL+tUqvCloJHtwrgQjIqaglPMlvlsguLqf05LbvmtVNNu54slr1Nt3BndliOCrmqPoe7YM6rrVUdWyx6jeWSnBm3J9F+LkrEze0qyU6WbPaEwQ1uctE8cIVzFk2N/qg33YYCJPMoML1/qbcQL5NJnSuIzmwfYWxNpPNzW20mTb8LTIrILuVkdUXhMoQrDufol42I0DLLs0tf3OVGIWDoc/cv8w2iO90cBqbAb48iy/wwu+KPzMmZzX28tg/KYWWPfodsIpvWWx1mHgCS4NONB/1KHAA= ---END GANDCRAB KEY--- ---BEGIN PC DATA--- 7ftDEgLb/ZS0lcmZbHM61KDJ6AOtD78KkA7absMgUXYxWLsC+5+UYF9xVmDn9NDJOpDVAuOVrODPRW7IKnQXQzua3LPyzokSUuglaqKXwabsGM4pXku5In6gtMQMqg7sgEh1XW1iPMFgiUj/s1LdWpJHdiPjMpn7rCZNO/A31mak0K8RefoREu3BxtlAsseHWfVIIKN0U4NnA3w0Ga7XDLlF3iOIB6ImYbF6Z/7MBN2mgBr2rZ2gU1R7jNx2WKAyu4W+5zlHFnKwMISBi1CwemOo6FrxnP+Z5F9bSR7OvDBsmLj7oYD6GBgpBqj3RSAVfvfE0yZSXyCRtLeJdNALBidq/MY5R7G3NbHOmdWR3kfSP9ry9fM3LLbjWKP0r1BW4eYoT03JrPa/L0B0wffnS0ez96BFoTHFq52HPDCx6yhEudvoPVoM6iaVy+mvqAdvYbwBrtoyoC8D1f+lWjmY7qd4Auw+gT2wK0yub5gfz9wpLQCj3bimwDPi8jPeKPiggI2bWKz+7QkWvC2ihYFfEuZEsiM5ANPhxNQRIE71VEGTyf6MN51c1gY/+eQae2sEznTbCqfrOdcnPBOVfcolLq8b9AmRcCeV7bCGEZisVbSQnNiaPkJ9b5I041HXc2jSx6IODB3F1IH8qANwhkbcxMPGvnUSm+rK ---END PC DATA---

URLs

http://gandcrabmfe6mnef.onion/963b7a421bb39b21

Targets

- Target
  
  RNSM00366.7z
- Size
  
  9.4MB
- MD5
  
  46837db77a1738914d3e706e47dd063e
- SHA1
  
  8dc5b42cb708a3cd73a0af71742be7ea39389c5e
- SHA256
  
  38d06336598e9109435116705fcbc60f0d30eb697805bf6c5a09d414e51dca0b
- SHA512
  
  358176dfb1035ee7c8fce38119a6723be33b1ac5328a7e654ec1b2000b7e729bebc09493bc709ef0753d7ca72ae617d8d486322fa3683d182f34f8c4de0499be
- SSDEEP
  
  196608:CDGWPdy6PA9f98chi0spA9RAx2CjDFlOQC7ChOr1L/5aYBnj5RnT7neXj2S:KGWVRAoFCPCj5l67zBaYBj5Rn/neXx
Score

10^/10

azorult cryptolocker dharma formbook gandcrab globeimposter warzonerat backdoor credential_access defense_evasion discovery evasion execution impact infostealer persistence ransomware rat spyware stealer trojan upx
- Azorult
  An information stealer that was first discovered in 2016, targeting browsing history and passwords.
  trojan infostealer azorult
- Azorult family
  azorult
- CryptoLocker
  Ransomware family with multiple variants.
  ransomware cryptolocker
- Cryptolocker family
  cryptolocker
- Dharma
  Dharma is a ransomware that uses security software installation to hide malicious activities.
  ransomware dharma
- Dharma family
  dharma
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook family
  formbook
- GandCrab payload
- Gandcrab
  Gandcrab is a Trojan horse that encrypts files on a computer.
  ransomware backdoor gandcrab
- Gandcrab family
  gandcrab
- GlobeImposter
  GlobeImposter is a ransomware first seen in 2017.
  ransomware globeimposter
- Globeimposter family
  globeimposter
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- WarzoneRat, AveMaria
  WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
  rat infostealer warzonerat
- Warzonerat family
  warzonerat
- Windows security bypass
  evasion trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Renames multiple (253) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Adds policy Run key to start application
  persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Uses the VBS compiler for execution
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1