RANSOM.WIN32.GANDCRAB.B

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It connects to certain websites to send and receive information. It takes advantage of certain vulnerabilities. It deletes itself after execution.

It drops files as ransom note.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops the following files:

• %User Temp%\pidor.bmp
• {Encrypted Folder}\{Random}-DECRYPT.txt

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, and 8.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• Global\{Hex Values}.lock

Other System Modifications

This Ransomware adds the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\ex_data\
data
ext = {Hex Values}

HKEY_LOCAL_MACHINE\SOFTWARE\keys_data\
data
public = {KEY}

HKEY_LOCAL_MACHINE\SOFTWARE\keys_data\
data
private = {KEY}

It changes the desktop wallpaper by modifying the following registry entries:

HKEY_CURRENT_USER\Control Panel\Desktop
Wallpaper = "%User Temp%\pidor.bmp"

It sets the system's desktop wallpaper to the following image:

Process Termination

This Ransomware terminates the following processes if found running in the affected system's memory:

• msftesql.exe
• sqlagent.exe
• sqlbrowser.exe
• sqlwriter.exe
• oracle.exe
• ocssd.exe
• dbsnmp.exe
• synctime.exe
• agntsvc.exe
• isqlplussvc.exe
• xfssvccon.exe
• sqlservr.exe
• mydesktopservice.exe
• ocautoupds.exe
• agntsvc.exe
• agntsvc.exe
• agntsvc.exe
• encsvc.exe
• firefoxconfig.exe
• tbirdconfig.exe
• mydesktopqos.exe
• ocomm.exe
• mysqld.exe
• mysqld-nt.exe
• mysqld-opt.exe
• dbeng50.exe
• sqbcoreservice.exe
• excel.exe
• infopath.exe
• msaccess.exe
• mspub.exe
• onenote.exe
• outlook.exe
• powerpnt.exe
• steam.exe
• thebat.exe
• thebat64.exe
• thunderbird.exe
• visio.exe
• winword.exe
• wordpad.exe

Information Theft

This Ransomware gathers the following data:

• Username
• Computer Name
• Network Information
• System Language
• Machine Keyboard Layout
• OS Version and Platform
• AV Products Installed
• Processor Information
• IP Address
• Drives Information (Nerwork or Local)
• Ransom ID
• GandCrab Internal Info:
  • id
  • sub_id
  • version
  • action

Other Details

This Ransomware connects to the following website to send and receive information:

• http://{URL}/{string1}/{string2}/{string3}.{string4}
• Where URL is equal to the following:
  • www.{BLOCKED}impex.com
  • www.{BLOCKED}egrise.eu
  • www.{BLOCKED}g.com
  • {BLOCKED}photo.ru
  • {BLOCKED}mpany.ru
  • www.{BLOCKED}undation.gm
  • www.{BLOCKED}tfunnelblueprint.com
  • www.{BLOCKED}ear.com
  • {BLOCKED}da74.ru
  • {BLOCKED}t.net
  • {BLOCKED}babyphotographyseattle.com
  • {BLOCKED}m.be
  • {BLOCKED}owradio.com
  • {BLOCKED}p.com
  • {BLOCKED}t.fr
  • {BLOCKED}emi.com
  • www.{BLOCKED}v.hu
  • www.{BLOCKED}d.cz
  • {BLOCKED}n.cn
  • {BLOCKED}d.website
  • {BLOCKED}inen.com
  • {BLOCKED}mores.com.br
  • {BLOCKED}n.dk
  • {BLOCKED}a.co.uk
  • www.{BLOCKED}s.co.th
  • {BLOCKED}tplus.ru
  • {BLOCKED}s.vn
  • {BLOCKED}isleri.com
  • www.{BLOCKED}viacao.com.br
  • www.{BLOCKED}t.in
  • www.{BLOCKED}tedelixir.com
  • www.{BLOCKED}agrp.com
  • {BLOCKED}me-fishing-croatia.hr
  • {BLOCKED}onacif.com
  • www.{BLOCKED}ssconnect.com
  • {BLOCKED}edding.ru
  • {BLOCKED}t.{BLOCKED}view.com
  • {BLOCKED}rica.com.mx
  • {BLOCKED}l.com.ve
  • {BLOCKED}ns.com.vn
  • {BLOCKED}alm.eu
  • {BLOCKED}egas.com
  • {BLOCKED}l.by
  • www.{BLOCKED}landgolf.dk
  • {BLOCKED}ravel2018.com
  • {BLOCKED}lancus.pl
  • {BLOCKED}motors.in
  • {BLOCKED}ypolyana123.ru
  • {BLOCKED}oli.org
  • {BLOCKED}eed.club
  • {BLOCKED}h.lu
  • {BLOCKED}v.com.br
  • {BLOCKED}dinn.us
  • {BLOCKED}2.ru
  • {BLOCKED}ibilisim.com
  • {BLOCKED}k.com
  • {BLOCKED}s.co.uk
  • {BLOCKED}obalholding.com
  • {BLOCKED}orgasmo.cl
  • www.{BLOCKED}ine.fr
  • {BLOCKED}ens.com
  • www.{BLOCKED}iasystems.com
  • {BLOCKED}palcity.top
  • {BLOCKED}iddleeastgate.com
  • {BLOCKED}adsn2ag7e.xn--p1ai
  • www.{BLOCKED}a.com.br
  • {BLOCKED}avc1e.xn--p1acf
  • www.{BLOCKED}inapetrou.co.uk
  • www.{BLOCKED}od.co.uk
  • www.{BLOCKED}thfully.com
  • {BLOCKED}adesenacpe.edu.br
  • {BLOCKED}lharf.com
  • www.{BLOCKED}ventos.com.br
  • www.{BLOCKED}deayrs.com
  • {BLOCKED}art.fr
  • www.{BLOCKED}gortaaydin.com
  • {BLOCKED}y.com
  • {BLOCKED}m.com
  • {BLOCKED}hirty.pl
  • {BLOCKED}eerd.nl
  • {BLOCKED}orp.link
  • {BLOCKED}kongtrul.org.tw
  • {BLOCKED}hos.com
  • {BLOCKED}co.ir
  • {BLOCKED}ervice.ru
  • {BLOCKED}ts.com
  • www.{BLOCKED}ag.kiev.ua
  • {BLOCKED}com.cf
  • www.{BLOCKED}a.cat
  • {BLOCKED}les-noisetiers.fr
  • www.{BLOCKED}1.ir
  • {BLOCKED}rd.com
  • {BLOCKED}vener.org
  • {BLOCKED}r.ga
  • {BLOCKED}ergym.nl
  • {BLOCKED}rms.mx
  • www.{BLOCKED}inn.com
  • {BLOCKED}b.com.pl
  • {BLOCKED}clinic.com
  • www.{BLOCKED}skel.net
  • {BLOCKED}t.nu
  • www.{BLOCKED}mviet.com
  • www.{BLOCKED}dent.com
  • www.{BLOCKED}tel.it
  • www.{BLOCKED}eriors.com
  • {BLOCKED}o.com.au
  • {BLOCKED}ec.com.mx
  • www.{BLOCKED}rmdnsalonlar-fjb55aa34dpkdo.com
  • {BLOCKED}leng.com
  • {BLOCKED}yetsanthaomeo.com
  • {BLOCKED}withmakeup.co.uk
  • www.{BLOCKED}k.com
  • {BLOCKED}olita.es
  • {BLOCKED}guridad.com
  • {BLOCKED}group.com
  • www.{BLOCKED}t.travel
  • {BLOCKED}tudio.com.my
  • www.{BLOCKED}etoit.fr
  • {BLOCKED}um.com.ua
  • www.{BLOCKED}s-for-kids.de
  • www.{BLOCKED}ire.com
  • {BLOCKED}resa.com
  • {BLOCKED}escangio.viethomes.land
  • {BLOCKED}ongroup.com
  • {BLOCKED}odazha.ru
  • {BLOCKED}n.net
  • www.{BLOCKED}a.com.br
  • www.{BLOCKED}oiscours.com
  • {BLOCKED}afilho.com.br
  • {BLOCKED}r.kz
  • {BLOCKED}caligrafosevilla.es
  • {BLOCKED}mani.net
  • www.{BLOCKED}re.fr
  • www.{BLOCKED}i.com
  • www.{BLOCKED}bn.com
  • {BLOCKED}hrtek.yourcloud.cz
  • www.{BLOCKED}o.ir
  • www.{BLOCKED}ansport.fr !--BLOCKED www.classtransport.fr -->
  • {BLOCKED}ndshandyman.com
  • {BLOCKED}inegames.pro
  • www.{BLOCKED}orideas9.com
  • www.{BLOCKED}echarro.com
  • www.{BLOCKED}ews.com
  • {BLOCKED}selamatankerja.co
  • {BLOCKED}b.com
  • www.{BLOCKED}i.co
  • www.{BLOCKED}sants.com
  • {BLOCKED}rkservicesinc.com
  • {BLOCKED}nabis.com
  • {BLOCKED}ntropetrolina.com
  • {BLOCKED}folks.com
  • www.{BLOCKED}havetoshine.com
  • www.{BLOCKED}icholasossai.com
  • www.{BLOCKED}puters.ro
  • {BLOCKED}rde.com
  • www.{BLOCKED}s.com
  • www.{BLOCKED}eyprotein.com
  • www.{BLOCKED}igitalweb.com
  • www.{BLOCKED}1.sr
  • {BLOCKED}raditions.nl
  • {BLOCKED}ud.com
  • {BLOCKED}ikalavathi.info
  • {BLOCKED}viez.com
  • {BLOCKED}nsult.com
  • {BLOCKED}aching.fr
  • {BLOCKED}ight.ru
  • {BLOCKED}tore.com
  • www.{BLOCKED}omfortable.com
  • www.{BLOCKED}hotevents.com
  • {BLOCKED}s.kiev.ua
  • www.{BLOCKED}eacademy.com
  • {BLOCKED}casinoterpercaya.com
  • {BLOCKED}ply.com
  • {BLOCKED}on7tanphu.com
  • {BLOCKED}ball24h.com
  • {BLOCKED}kapner.com
  • {BLOCKED}v.ro
  • www.{BLOCKED}a.co.uk
  • {BLOCKED}ctg.com
  • {BLOCKED}e.com.vn
  • {BLOCKED}omputer.com.br
  • {BLOCKED}analuxe.lviv.ua
  • {BLOCKED}dim.org
  • www.{BLOCKED}nto.com
  • www.{BLOCKED}barua.com
  • {BLOCKED}en.com
  • {BLOCKED}ton.com
  • www.{BLOCKED}cherd.com
  • {BLOCKED}rno.com
  • {BLOCKED}.{BLOCKED}.{BLOCKED}.222
  • {BLOCKED}.{BLOCKED}.99.165
  • {BLOCKED}ayrimenkul.com
  • {BLOCKED}.{BLOCKED}.1.219
  • {BLOCKED}ndicraft.com
  • {BLOCKED}oft.in
  • {BLOCKED}.{BLOCKED}.96.238
  • {BLOCKED}latpars.ir
  • {BLOCKED}.{BLOCKED}.17.9
  • {BLOCKED}kids.com.ua
  • {BLOCKED}rdstone.com
  • {BLOCKED}night.cz
  • {BLOCKED}intakeaway.com
  • {BLOCKED}urk.club
  • {BLOCKED}s.top
  • {BLOCKED}stest9.uk
  • {BLOCKED}rie.lemarchefrais.com
  • {BLOCKED}carpet.com
  • {BLOCKED}agroupbd.com
  • {BLOCKED}g.{BLOCKED}t.com
  • {BLOCKED}inhduong.com
  • {BLOCKED}que.com
  • {BLOCKED}n.com
  • {BLOCKED}d.com
  • {BLOCKED}oiles.com
  • {BLOCKED}ooomdevserver.com
  • {BLOCKED}llhdb.com
  • {BLOCKED}p.fr
  • {BLOCKED}m.andreea.alexandroni.ro
  • {BLOCKED}sbuildcon.com
  • {BLOCKED}g.{BLOCKEDe.com
  • {BLOCKED}show.com
  • {BLOCKED}g.swingtaiwan.com
  • {BLOCKED}oft.com
  • {BLOCKED}ngrosebd.com
  • {BLOCKED}tyempire.com
  • {BLOCKED}ocarro.com.br
  • {BLOCKED}flirtings.com
  • {BLOCKED}g.damngood.mx
  • {BLOCKED}vanlines.com
  • {BLOCKED}a.no
  • {BLOCKED}ck.ncplinc.net
  • {BLOCKED}marketplace.eu
  • {BLOCKED}enceiling.com.hk
  • {BLOCKED}intpl.com
  • {BLOCKED}osetselfstorage.com
  • {BLOCKED}roms.cba.pl
  • {BLOCKED}-services.com
  • {BLOCKED}ripcustomercare.com
  • {BLOCKED}g.party
  • {BLOCKED}rv.pixelsco.com
  • {BLOCKED}emena.com
  • {BLOCKED}oducciones.com.gt
  • {BLOCKED}lo.altervista.org
  • {BLOCKED}ent.com
  • {BLOCKED}2.bokshaber.net
  • {BLOCKED}t.co.kr
  • {BLOCKED}e.biz
  • {BLOCKED}iketler.com
  • {BLOCKED}v.{BLOCKED}wilshiremedical.com
  • {BLOCKED}obox.org
  • {BLOCKED}pisy.cba.pl
  • {BLOCKED}gigimuda.com
  • {BLOCKED}c.{BLOCKED}almea.info
  • {BLOCKED}bostad.se
  • {BLOCKED}ecimientos.sintinovoy.sevapp20.com
  • {BLOCKED}s.com.br
  • {BLOCKED}h.org.tr
  • {BLOCKED}i.ga
  • {BLOCKED}r.es
  • {BLOCKED}kpick.com
  • {BLOCKED}kiprzemek.cba.pl
  • {BLOCKED}x.org
  • {BLOCKED}hope.org
  • {BLOCKED}.{BLOCKED}.113.170
  • {BLOCKED}ctor.mobi
  • {BLOCKED}iritgroup.altervista.org
  • {BLOCKED}hservicos.com.br
  • {BLOCKED}s.mobi
  • {BLOCKED}petshop.life
  • {BLOCKED}tszott.cba.pl
  • {BLOCKED}cafiorino1.altervista.org
  • {BLOCKED}ng.info
  • {BLOCKED}8.com
  • {BLOCKED}sy.cba.pl
  • {BLOCKED}s.foco.cl
  • {BLOCKED}oy.com
  • {BLOCKED}anes.altervista.org
  • {BLOCKED}lumbria.it
  • {BLOCKED}s-china.com
  • {BLOCKED}interiordecorators.com
  • {BLOCKED}idadpma.com
  • {BLOCKED}ster.ml
  • {BLOCKED}anau.com
  • {BLOCKED}te.com
  • {BLOCKED}dcheesereviews.com
  • {BLOCKED}iptraction.com
  • {BLOCKED}aplanmark.com.br
  • {BLOCKED}g.ruichuangfagao.com
  • {BLOCKED}oulsonfire.com
  • {BLOCKED}stsystems.com
  • {BLOCKED}app.com
  • {BLOCKED}.{BLOCKED}.187.178
  • {BLOCKED}renterprising.com
  • {BLOCKED}lower.ee
  • {BLOCKED}tocatchacold.com
  • {BLOCKED}t.com
  • {BLOCKED}e-opalac.cba.pl
  • {BLOCKED}ul212tesisat.com
  • {BLOCKED}g-ug.ru
  • {BLOCKED}veis.imb.br
  • {BLOCKED}itelmakinasi.com
  • {BLOCKED}dans.com
  • {BLOCKED}tury.com
  • {BLOCKED}.{BLOCKED}.br
  • {BLOCKED}on-restauracja.cba.pl
  • {BLOCKED}anna.no
  • {BLOCKED}aria-crm.pl
  • {BLOCKED}atica.uss.cl
  • {BLOCKED}heatpumps.nz
  • {BLOCKED}i.com
  • {BLOCKED}ngjiang.com
  • {BLOCKED}treet.com
  • {BLOCKED}d.ru
  • {BLOCKED}an.cba.pl
  • {BLOCKED}.{BLOCKED}.co
  • {BLOCKED}z.com
  • {BLOCKED}j.cn
  • {BLOCKED}rajasthan.allappshere.in
  • {BLOCKED}ang.com
  • {BLOCKED}lier.com.au
  • {BLOCKED}rb-rezept.com
  • {BLOCKED}g.ase.ro
  • {BLOCKED}ocellitancredi.com
  • {BLOCKED}d.{BLOCKED}.{BLOCKED}ve-platform.net
  • {BLOCKED}tgiao.com
  • {BLOCKED}darexpress.com
  • {BLOCKED}nh345.com
  • {BLOCKED}eex.com
  • {BLOCKED}entreprise.dk
  • {BLOCKED}.{BLOCKED}.id
  • {BLOCKED}laza.com
  • {BLOCKED}a.it
  • {BLOCKED}p.pro
  • {BLOCKED}actrice-web.com
  • {BLOCKED}akdee.com
  • {BLOCKED}t.cba.pl
  • {BLOCKED}e.{BLOCKED}b.com
  • {BLOCKED}n.com
  • {BLOCKED}c.ma
  • {BLOCKED}.ir
  • {BLOCKED}s.pt
  • {BLOCKED}d.cba.pl
  • {BLOCKED}ur.com
  • {BLOCKED}haiduong.com
  • {BLOCKED}.{BLOCKED}.br
  • {BLOCKED}z.com
  • {BLOCKED}a.kg
  • {BLOCKED}ai.pl
  • {BLOCKED}r.csit.rmit.edu.au
  • {BLOCKED}z.com
  • {BLOCKED}i.hu
  • {BLOCKED}azr.com
  • {BLOCKED}oyang.com
  • {BLOCKED}ao7.com
  • {BLOCKED}est.com
  • {BLOCKED}tracting.ca
  • {BLOCKED}i-danasnje.info
  • {BLOCKED}kson.com
  • {BLOCKED}erfetto.com.br
  • {BLOCKED}s.info
  • {BLOCKED}gillusion.com
  • {BLOCKED}imoveis.vistatemporario.com.br
  • {BLOCKED}r.com
  • {BLOCKED}l.{BLOCKED}.il
  • {BLOCKED}ontics.ir
  • {BLOCKED}.{BLOCKED}tlerocknews.org
  • {BLOCKED}distributor.com
  • {BLOCKED}earth.com
  • {BLOCKED}costruzioneabruzzo.piattaforma.eu
  • {BLOCKED}tockfilms.com
  • {BLOCKED}itshop.com
  • {BLOCKED}esurgerythailand.com
  • {BLOCKED}r.cn
  • {BLOCKED}dia.se
  • {BLOCKED}b.com
  • {BLOCKED}lmastah.com
  • {BLOCKED}n.ukmforum.com
  • {BLOCKED}ormacontralaprivatizaciondelcyii.org
  • {BLOCKED}to.ru
  • {BLOCKED}etih.com
  • {BLOCKED}nkeren.xyz
  • {BLOCKED}glish.com
  • {BLOCKED}thaoland.com
  • {BLOCKED}tinasat.com.br
  • {BLOCKED}n.cba.pl
  • {BLOCKED}t.{BLOCKED}entures.com
  • {BLOCKED}urghbbq.com
  • {BLOCKED}ankaravekil.com
  • {BLOCKED}netcctv.com
  • {BLOCKED}k.com
  • {BLOCKED}edu.com
  • {BLOCKED}onsel.com
  • {BLOCKED}gflames.com
  • {BLOCKED}.{BLOCKED}t.ir
  • {BLOCKED}e-gruttepier.nl
  • {BLOCKED}d.{BLOCKED}.pl
  • {BLOCKED}nko.dp.ua
  • {BLOCKED}esdeflex.com.br
  • {BLOCKED}eriatrics.org
  • {BLOCKED}kagd.com
  • {BLOCKED}l.{BLOCKED}opv.pp.ua
  • {BLOCKED}rrstrom.com
  • {BLOCKED}lloff-italy.web5s.com
  • {BLOCKED}lar.kz
  • {BLOCKED}ealer.fr
  • {BLOCKED}k.{BLOCKED}i.go.id
  • {BLOCKED}delcarratore.it
  • {BLOCKED}ohio.pbd-dev.com
  • {BLOCKED}nc.com
  • {BLOCKED}iindonesia.co.id
  • {BLOCKED}reation.com
  • {BLOCKED}osing.ir
  • {BLOCKED}orlddirect.co.uk
  • {BLOCKED}ia.vn
  • {BLOCKED}.{BLOCKED}ay
  • {BLOCKED}ckimnguyenphat.com.vn
  • {BLOCKED}t.{BLOCKED}ia.se
  • {BLOCKED}t.{BLOCKED}-experten.be
  • {BLOCKED}s.cl
  • {BLOCKED}t.{BLOCKED}i.pl
  • {BLOCKED}t.{BLOCKED}ucevherat.com
  • {BLOCKED}spire.co.uk
  • {BLOCKED}ermei.xyz
  • {BLOCKED}n.com
  • {BLOCKED}nbygger.se
  • {BLOCKED}s.{BLOCKED}ydigital.com.au
  • {BLOCKED}exports.com
  • {BLOCKED}ofminthill.com
  • {BLOCKED}-int.karibuni.be
  • {BLOCKED}site.aithent.com
  • {BLOCKED}evanguard.co.uk
  • {BLOCKED}rdupain.it
  • {BLOCKED}decor.net
  • {BLOCKED}vereventvideo.com
  • {BLOCKED}irek.com
  • {BLOCKED}urse.com
  • {BLOCKED}power-music.cba.pl
  • {BLOCKED}amifier.com
  • {BLOCKED}usebangladesh.com
  • {BLOCKED}.{BLOCKED}t.fr
  • {BLOCKED}x.us
  • {BLOCKED}chts-pyramide.tk
  • {BLOCKED}mpoptions.com
  • wp.{BLOCKED}s.men
  • {BLOCKED}keting.cinfoway.in
  • {BLOCKED}ey.com
  • {BLOCKED}t.tk
  • {BLOCKED}ouropinions.net
  • {BLOCKED}xi.net
  • www.{BLOCKED}arayan.com
  • {BLOCKED}pert.com
  • {BLOCKED}ainvest.com.br
  • www.{BLOCKED}pyme.biz
  • www.{BLOCKED}i.nl
  • {BLOCKED}-fenster.ch
  • www.{BLOCKED}oc.com.vn
  • {BLOCKED}e.com.mx
  • www.{BLOCKED}ire.com
  • www.{BLOCKED}liditalia.it
  • www.{BLOCKED}intpl.com
  • www.{BLOCKED}ri.edu.in
  • www.{BLOCKED}c.com
  • www.{BLOCKED}albania.com
  • www.{BLOCKED}er.pt
  • www.{BLOCKED}aola.com
  • www.{BLOCKED}dans.com
  • www.{BLOCKED}andimperatives.org
  • www.{BLOCKED}0.us
  • www.{BLOCKED}able.club
  • www.{BLOCKED}c.ma
  • www.{BLOCKED}t.co.kr
  • www.{BLOCKED}s.pt
  • www.{BLOCKED}fantilvalencia.com
  • www.{BLOCKED}z.com
  • www.{BLOCKED}shi.cn
  • www.{BLOCKED}hool.vn
  • www.{BLOCKED}tury.com
  • www.{BLOCKED}olutionsbd.com
  • www.{BLOCKED}pharmassist.com
  • www.{BLOCKED}sistemas.com.br
  • www.{BLOCKED}turistului.com
  • www.{BLOCKED}news.com
  • www.{BLOCKED}leshairlounge.ca
  • {BLOCKED}enty.com
  • www.{BLOCKED}rmatica.pt
  • {BLOCKED}es.in
  • www.{BLOCKED}profile.com
  • www.{BLOCKED}odbd.com
  • www.{BLOCKED}iarepentigny.ca
  • www.{BLOCKED}chat.com
  • www.{BLOCKED}concepts-cm.com
  • www.{BLOCKED}asure.com
  • www.{BLOCKED}1.com
  • www.{BLOCKED}agricola.com.br
  • www.{BLOCKED}l.com
  • www.{BLOCKED}fmats.com
  • {BLOCKED}hinipassofundo.com.br
  • www.{BLOCKED}r.com
  • www.{BLOCKED}laybasket.fr
  • www.{BLOCKED}ect.fr
  • www.{BLOCKED}eil.de
  • www.{BLOCKED}n.com
  • www.{BLOCKED}l.com
  • www.{BLOCKED}a.cn
  • www.{BLOCKED}casantiago.com.br
  • {BLOCKED}acidsedek.xn--p1acf
  • www.{BLOCKED}oft.hn
  • www.{BLOCKED}eassembly.com
  • www.{BLOCKED}lars.com
  • {BLOCKED}oup.com
  • www.{BLOCKED}wa.com
  • www.{BLOCKED}eo.com
  • www.{BLOCKED}onecenter.com
  • {BLOCKED}ity.com
  • {BLOCKED}sbestphotography.com
  • www.{BLOCKED}rco.com
  • www.{BLOCKED}e.com
  • www.{BLOCKED}ja.com
  • www.{BLOCKED}a.tn
  • {BLOCKED}o.com
  • {BLOCKED}creativeco.com
  • www.{BLOCKED}m.cn
  • {BLOCKED}ngguoji.com
  • www.{BLOCKED}e.com
  • {BLOCKED}gbmoredjsteve.com
  • {BLOCKED}asar.com
  • {BLOCKED}odelbastarr.com
  • {BLOCKED}a-quest.com.ua
  • {BLOCKED}n.studio
  • {BLOCKED}rketing.agency
  • {BLOCKED}ncemarketingtraining.com
  • {BLOCKED}uilder.com
  • {BLOCKED}blue.com
  • {BLOCKED}anatco.com
  • {BLOCKED}grup.com.tr
  • www.{BLOCKED}iatravel.in
  • {BLOCKED}i24.ru
  • {BLOCKED}ck.com
  • www.{BLOCKED}sharma.live
  • {BLOCKED}bg.com
  • www.{BLOCKED}apalhanoimoveis.com.br
  • {BLOCKED}u.com
  • {BLOCKED}tore.com
  • www.{BLOCKED}nle.com
  • {BLOCKED}da.ru
  • {BLOCKED}resultado.com
  • {BLOCKED}erin-duisburg.net
  • {BLOCKED}ro.ru
  • www.{BLOCKED}rstrom.com
  • {BLOCKED}y-work.ru
  • {BLOCKED}dea.com
  • {BLOCKED}urs-tut.ru
  • {BLOCKED}s.top
  • {BLOCKED}ndacion.es
  • {BLOCKED}khoemanhtunhien.com
  • {BLOCKED}ndacion.eu
  • {BLOCKED}undation.es
  • {BLOCKED}eship.top
  • www.{BLOCKED}s.com.cn
  • www.{BLOCKED}horsepower.se
  • www.{BLOCKED}sign.com
  • {BLOCKED}velnext.com
  • {BLOCKED}townbooks.com
  • {BLOCKED}matabunda.com
  • {BLOCKED}network.com.ng
  • {BLOCKED}aftcustom.com
  • {BLOCKED}trealty.com
  • {BLOCKED}tel.com
  • {BLOCKED}erview.com.vn
  • {BLOCKED}er.com
  • {BLOCKED}u.vn
  • {BLOCKED}.{BLOCKED}ing.io
  • {BLOCKED}iler.com
  • {BLOCKED}y.org.in
  • {BLOCKED}cordo.com
  • {BLOCKED}ng.cn
  • {BLOCKED}opastuh.ru
  • {BLOCKED}encesdiary.com
  • {BLOCKED}app.be
  • {BLOCKED}isha.com
  • {BLOCKED}jodi.com
  • {BLOCKED}ultibrasil.com.br
  • {BLOCKED}tal.com
  • {BLOCKED}esona.com
  • {BLOCKED}tsbank.cc
  • www.{BLOCKED}iaexpeditionsperu.com
  • {BLOCKED}ukuk.com
  • {BLOCKED}gbrazil.com
  • {BLOCKED}isseta.com
  • {BLOCKED}iedrama.online
  • {BLOCKED}company.com
  • {BLOCKED}.{BLOCKED}.17.237
  • {BLOCKED}tessa.com
  • {BLOCKED}7sbbax1aamaagfpjbdc3dm.xn--p1ai
  • {BLOCKED}s.kiev.ua
  • {BLOCKED}adeplata23.com
  • www.{BLOCKED}in.com
  • {BLOCKED}x.com.ua
  • {BLOCKED}marketing.com
  • {BLOCKED}hingsale.com
  • {BLOCKED}booth.com.au
  • {BLOCKED}-utama.com
  • {BLOCKED}ampustaksi.com.tr
  • www.{BLOCKED}ifbumipersada.com
  • {BLOCKED}hcondotel.site
  • {BLOCKED}stions.ru
  • {BLOCKED}ams.ir
  • {BLOCKED}360.pl
  • {BLOCKED}hoh.com
  • {BLOCKED}esign.ru
  • {BLOCKED}cizade.com.tr
  • {BLOCKED}sna.com.ua
  • {BLOCKED}-vent.ru
  • {BLOCKED}duc.info
  • {BLOCKED}a.com.br
  • www.{BLOCKED}h.com.my
  • {BLOCKED}t.org
  • www.{BLOCKED}evenrice.com
  • {BLOCKED}oivietnam.com
  • {BLOCKED}trition.com.tr
  • {BLOCKED}alip.com
  • {BLOCKED}ulness.com.ua
  • www.{BLOCKED}wwaffle.xyz
  • www.{BLOCKED}s.space
  • {BLOCKED}ampsnorth.robomateplus.com
  • {BLOCKED}geulis.com
  • {BLOCKED}asepromotions.co.za
  • {BLOCKED}rsonal.com.ua
  • {BLOCKED}ev.com
  • {BLOCKED}rmatique.ca
  • {BLOCKED}13.hospedagemdesites.ws
  • {BLOCKED}.{BLOCKED}.17.155
  • {BLOCKED}dlife.in
  • {BLOCKED}genharia.hospedagemdesites.ws
  • {BLOCKED}ermocaldeiras.com.br
  • {BLOCKED}ro.com
  • www.{BLOCKED}group.com.hk
  • {BLOCKED}tanewsende.com
  • {BLOCKED}ergy.co.nz
  • {BLOCKED}feder.com
  • {BLOCKED}event.com.ua
  • www.{BLOCKED}guardthemovie.com
  • www.{BLOCKED}pdate.ir
  • {BLOCKED}ackpt.com
  • www.{BLOCKED}arpaslanmaz.com
  • {BLOCKED}.{BLOCKED}.241.0
  • {BLOCKED}arpati.com
  • {BLOCKED}ow.com.br
  • {BLOCKED}r.com.ua
  • {BLOCKED}z.io
  • {BLOCKED}t.eu
  • {BLOCKED}eb.com
  • {BLOCKED}piwater.com
  • www.{BLOCKED}i.com.br
  • {BLOCKED}.{BLOCKED}ow.com.br
  • {BLOCKED}uit.fr
  • {BLOCKED}carpentry.training
  • {BLOCKED}v.ru
  • www.{BLOCKED}erabad.com
  • www.{BLOCKED}aching.com.au
  • www.{BLOCKED}nsena.co.in
  • www.{BLOCKED}akliye.com
  • {BLOCKED}ceans-td.com
  • {BLOCKED}e.fr
  • {BLOCKED}h.fr
  • {BLOCKED}d.com
  • {BLOCKED}da.info
  • {BLOCKED}on.org
  • {BLOCKED}itabela.com
  • www.{BLOCKED}ss.com
  • www.{BLOCKED}imports.com.br
  • {BLOCKED}inesdedemain.com
  • www.{BLOCKED}arcisi.com
  • {BLOCKED}ios.com
  • www.{BLOCKED}alaptop.com
  • {BLOCKED}dset.com
  • {BLOCKED}etnam.com
  • {BLOCKED}a-ciudadana.es
  • {BLOCKED}K.com
  • {BLOCKED}t-pascal.fr
  • {BLOCKED}kingcare.com
  • {BLOCKED}U.ru
  • www.{BLOCKED}touch.uk.com
  • www.{BLOCKED}i.co.il
  • www.{BLOCKED}s-interieurs.net
  • {BLOCKED}n.com
  • {BLOCKED}ut-journalisme.fr
  • www.{BLOCKED}t.com
  • {BLOCKED}am.com
  • {BLOCKED}li.fi
  • {BLOCKED}deck.com
  • {BLOCKED}low.world
  • {BLOCKED}.{BLOCKED}.99.104
  • www.{BLOCKED}tal.com
  • {BLOCKED}ap.com
  • {BLOCKED}dgoals.com
  • {BLOCKED}lagosta.cat
  • {BLOCKED}wood.store
  • {BLOCKED}inoadvogados.com.br
  • {BLOCKED}fund.org
  • {BLOCKED}r.com
  • {BLOCKED}cetalentos.com.br
  • {BLOCKED}aphics.com
  • www.{BLOCKED}opic.ru
  • {BLOCKED}up.co.uk
  • {BLOCKED}vestforum.com
  • {BLOCKED}los.ru
  • www.{BLOCKED}rsskn.com
  • www.{BLOCKED}mare.it
  • {BLOCKED}aanbmdrdpayqtg1d7h.xn--p1ai
  • www.{BLOCKED}ouyesh.com
  • {BLOCKED}i.es
  • {BLOCKED}onetransportation.com
  • {BLOCKED}n.com.br
  • www.{BLOCKED}caderma.com
  • {BLOCKED}radio.com
  • www.{BLOCKED}vten.xyz
  • www.{BLOCKED}k.com
  • {BLOCKED}na.ru
  • {BLOCKED}N.com
  • {BLOCKED}-jkt.sch.id
  • {BLOCKED}corp.es
  • {BLOCKED}O.com
  • www.{BLOCKED}vie.fr
  • www.{BLOCKED}olfales.com
  • {BLOCKED}stay.com
  • {BLOCKED}ea.biz
  • {BLOCKED}o-beckers.de
  • {BLOCKED}r.ro
  • {BLOCKED}.com.ve
  • {BLOCKED}htrinh.net
  • {BLOCKED}s.ir
  • {BLOCKED}ans.com
  • {BLOCKED}t.com
  • {BLOCKED}crepelle.com
  • {BLOCKED}oodgood.com
  • {BLOCKED}rkscalifornia.org
  • {BLOCKED}ine.kiev.ua
  • {BLOCKED}m.ovh
  • {BLOCKED}ily.org
  • {BLOCKED}t-hobby.com
  • {BLOCKED}k.com
  • {BLOCKED}radecorp.com
  • {BLOCKED}beyenal.com
  • www.{BLOCKED}stemsrl.net
  • {BLOCKED}dmanzi.com
  • {BLOCKED}arscooter.com
  • {BLOCKED}s.org
  • {BLOCKED}csamongus.com
  • {BLOCKED}lenka.ru
  • www.{BLOCKED}d.cz
  • {BLOCKED}rtvn.com
  • {BLOCKED}lconstructions.in
  • {BLOCKED}anquoc.com
  • {BLOCKED}ial-campinggear.com
  • {BLOCKED}tatrockwells.com
  • {BLOCKED}tusa.com
  • {BLOCKED}inhkientaocuocdoi.com
  • {BLOCKED}j.org
  • {BLOCKED}nali.com
  • www.{BLOCKED}v.news
  • {BLOCKED}gsanhuyphat68.com
  • {BLOCKED}zdelamorena.com
  • www.{BLOCKED}asil.com
  • {BLOCKED}er.net
  • www.{BLOCKED}frozen.com.hk
  • {BLOCKED}cadi.com
  • {BLOCKED}c.org
  • www.{BLOCKED}ntacars.com
  • {BLOCKED}4h.net
  • {BLOCKED}c.com
  • {BLOCKED}k.online
  • {BLOCKED}ueesthetiquepasteur.com
  • {BLOCKED}onito.com
  • {BLOCKED}stemsrl.net
  • {BLOCKED}iaparacoaches.com.br
  • {BLOCKED}ries-acl-37.fr
  • {BLOCKED}donationtoday.com
  • {BLOCKED}dan.es
  • {BLOCKED}chamber.org
  • {BLOCKED}restschools.com
  • {BLOCKED}rssupply.us
  • www.{BLOCKED}es-zoliennes.fr
  • {BLOCKED}dy.com.br
  • {BLOCKED}edy.ru
  • {BLOCKED}ickphotography.es
  • {BLOCKED}adedeflandre.com
  • www.{BLOCKED}m.org
  • {BLOCKED}o.org.ua
  • www.{BLOCKED}int.online
  • {BLOCKED}uverts.org
  • {BLOCKED}lopezr.com
  • {BLOCKED}ushipyard.com
  • {BLOCKED}rash.ir
  • {BLOCKED}luavm.com
  • {BLOCKED}rkeynow.com
  • {BLOCKED}illars.org.uk
  • {BLOCKED}uisman.com
  • {BLOCKED}ptivevideoproductions.com
  • {BLOCKED}ssodesignam.com.br
  • {BLOCKED}s.ltd
  • {BLOCKED}ate.com.ua
  • {BLOCKED}x.com
  • {BLOCKED}ontractors.com.au
  • {BLOCKED}rkameratene.no
  • {BLOCKED}t.com.ua
  • {BLOCKED}e.com
  • {BLOCKED}g.{BLOCKED}ang.com
  • {BLOCKED}o.ir
  • www.{BLOCKED}is.com
  • {BLOCKED}aat.com.tr
  • {BLOCKED}nd.me
  • {BLOCKED}to.ru
  • {BLOCKED}-girls.services
  • {BLOCKED}ab.com.sg
  • {BLOCKED}gham.com
  • {BLOCKED}a.com
  • {BLOCKED}iedesperchesboukhatem.fr
  • {BLOCKED}iya.com
  • {BLOCKED}businesskhabar.com
  • www.{BLOCKED}ndustries.org
  • {BLOCKED}com-berlin.de
  • {BLOCKED}nostours.com
  • {BLOCKED}adelsureste.com
  • {BLOCKED}ftbay.ru
  • {BLOCKED}t.com.kw
  • {BLOCKED}etaksi.net
  • {BLOCKED}ou.be
  • www.{BLOCKED}andmade.com
  • www.{BLOCKED}da.com
  • {BLOCKED}a.com
  • {BLOCKED}ovin.ir
  • {BLOCKED}tseitai.com
  • {BLOCKED}ictrainproductions.com
  • {BLOCKED}s.{BLOCKED}hachundkulturstiftung.de
  • {BLOCKED}sslifescience.com
  • www.{BLOCKED}anticseafoodcompany.com
  • {BLOCKED}swadefinance.co.uk
  • www.{BLOCKED}ptables.com
  • {BLOCKED}adentaldelgado.es
  • {BLOCKED}clark.com
  • {BLOCKED}ds.ir
  • www.{BLOCKED}i.com.sg
  • {BLOCKED}o.com.br
  • {BLOCKED}iwebvn.com
  • {BLOCKED}p.vn
  • {BLOCKED}schell.com
  • {BLOCKED}etal.net
  • {BLOCKED}pieds.be
  • {BLOCKED}e.com.br
  • {BLOCKED}ealty.com
  • {BLOCKED}go.com
  • {BLOCKED}herstech.com
  • {BLOCKED}nstructioncorp.com
  • {BLOCKED}sdrive.com
  • www.{BLOCKED}int.com
  • {BLOCKED}media.cf
  • {BLOCKED}ch.com
  • {BLOCKED}esofe.com
  • {BLOCKED}ide.es
  • {BLOCKED}s.dk
  • {BLOCKED}chnik.de
  • {BLOCKED}de.info
  • {BLOCKED}ays.ru
  • {BLOCKED}t.se
  • {BLOCKED}allery.ru
  • {BLOCKED}world-md.ru
  • {BLOCKED}ierparis75.ovh
  • {BLOCKED}spectehnika.ru
  • {BLOCKED}rma.com
  • {BLOCKED}ct3272.org
  • www.{BLOCKED}galowstay.in
  • {BLOCKED}artingnow.com
  • www.{BLOCKED}esspractice.cf
  • www.{BLOCKED}lm.ga
  • www.{BLOCKED}asapex.mx
  • {BLOCKED}college.com.au
  • {BLOCKED}losbenimar.es
  • {BLOCKED}7sbb5ad1beecki5h.xn--p1ai
  • {BLOCKED}apparel.no
  • {BLOCKED}me.ru
  • www.{BLOCKED}undig.at
  • {BLOCKED}k.com
  • {BLOCKED}ocnam.com
  • {BLOCKED}ravel.com
  • {BLOCKED}thangz.com
  • {BLOCKED}arroy.fr
  • {BLOCKED}aworld.signupvideo.com
  • www.{BLOCKED}opapi.com
  • {BLOCKED}toshow.com
  • {BLOCKED}l.world
  • {BLOCKED}bride.net
  • {BLOCKED}gtrans.com
  • {BLOCKED}ormervn.com
  • {BLOCKED}ne-city-ciputra.net
  • {BLOCKED}nenda.com
  • {BLOCKED}larsisters.ca
  • {BLOCKED}phamgia.com
  • {BLOCKED}.dk
  • {BLOCKED}school.com.br
  • {BLOCKED}hoidsorted.com
  • {BLOCKED}edia.com
  • www.{BLOCKED}obindumcltd.com
  • {BLOCKED}o.mx
  • {BLOCKED}sa.com
  • www.{BLOCKED}in2014.com
  • www.{BLOCKED}unenfantterrible.com
  • www.{BLOCKED}b.org
  • {BLOCKED}erjack.com
  • {BLOCKED}lhilldesign.com
  • {BLOCKED}m.com
  • {BLOCKED}ents.com
  • {BLOCKED}ardiologist.com
  • {BLOCKED}turf.org
  • {BLOCKED}mafoto.com
  • www.{BLOCKED}imos.com
  • {BLOCKED}ningzone.com
  • {BLOCKED}united.com
  • {BLOCKED}ondezigns.com
  • www.{BLOCKED}xs.biz
  • {BLOCKED}ley.com
  • {BLOCKED}carelandscape.com
  • {BLOCKED}roupllc.com
  • www.{BLOCKED}adodai.com
  • www.{BLOCKED}gbits.com
  • www.{BLOCKED}ey.com
  • {BLOCKED}r.com
  • {BLOCKED}ors-by-catherine.com
  • {BLOCKED}nnelly.com
  • {BLOCKED}ertainment.com
  • {BLOCKED}nyc.com
  • {BLOCKED}untrycamo.com
  • {BLOCKED}ox.com
  • www.{BLOCKED}ecenter.org
  • {BLOCKED}aevents.com
  • {BLOCKED}ignonline.com
  • www.{BLOCKED}anipisak.com
  • www.{BLOCKED}ationalmoversboston.com
  • {BLOCKED}ityphotoworkshops.com
  • {BLOCKED}hings.com
  • {BLOCKED}dawnschool.com
  • {BLOCKED}lk.ca
  • {BLOCKED}enirvana.com
  • www.{BLOCKED}y.com.br
  • {BLOCKED}k.com
  • {BLOCKED}ore.com
  • {BLOCKED}esign.com
  • {BLOCKED}tivemg.com
  • {BLOCKED}group.com
  • {BLOCKED}tllc.com
  • www.{BLOCKED}mobilyadekorasyon.com
  • {BLOCKED}ndrestaurantgroup.com
  • www.{BLOCKED}sdavetorganizasyon.com
  • {BLOCKED}allenentertainment.com
  • www.{BLOCKED}ervicesgroup.com
  • www.{BLOCKED}organizasyon.com
  • {BLOCKED}y.com
  • {BLOCKED}diovisual.com
  • {BLOCKED}adental.com.au
  • {BLOCKED}age_pedik.com
  • Where string1 is equal to the following:
    • wp-content
    • static
    • content
    • includes
    • data
    • uploads
    • news
  • Where string2 is equal to the following:
    • images
    • pictures
    • image
    • graphic
    • assets
    • pics
    • imgs
    • tmp
  • Where string3 is equal to the combination of the following:
    • im
    • de
    • ka
    • ke
    • am
    • es
    • so
    • fu
    • se
    • da
    • he
    • ru
    • me
    • mo
    • th
    • zu
  • Where string4 is equal to the following:
    • jpg
    • png
    • gif
    • bmp

  It does the following:

  • Avoids encrypting files with the following extensions:
    • .ani
    • .cab
    • .cpl
    • .cur
    • .diagcab
    • .diagpkg
    • .dll
    • .drv
    • .lock
    • .hlp
    • .ldf
    • .icl
    • .icns
    • .ico
    • .ics
    • .lnk
    • .key
    • .idx
    • .mod
    • .mpa
    • .msc
    • .msp
    • .msstyles
    • .msu
    • .nomedia
    • .ocx
    • .prf
    • .rom
    • .rtp
    • .scr
    • .shs
    • .spl
    • .sys
    • .theme
    • .themepack
    • .exe
    • .bat
    • .cmd
    • .gandcrab
    • .KRAB
    • .CRAB
    • .zerophage_i_like_your_pictures
  • delete shadow copies
  • It checks for the presence of the following antivirus and security applications:
    • AVP.EXE
    • ekrn.exe
    • avgnt.exe
    • ashDisp.exe
    • NortonAntiBot.exe
    • Mcshield.exe
    • avengine.exe
    • cmdagent.exe
    • smc.exe
    • persfw.exe
    • pccpfw.exe
    • fsguiexe.exe
    • cfp.exe
    • msmpeng.exe

  It takes advantage of the following vulnerabilities:

  • CVE-2018-8120 | Win32k Elevation of Privilege Vulnerability
  • CVE-2018-8440 | Windows ALPC Elevation of Privilege Vulnerability

  It deletes itself after execution.

  Ransomware Routine

  This Ransomware avoids encrypting files with the following strings in their file name:

  • desktop.ini
  • autorun.inf
  • ntuser.dat
  • iconcache.db
  • bootsect.bak
  • boot.ini
  • ntuser.dat.log
  • Thumbs.db
  • KRAB-DECRYPT.html
  • KRAB-DECRYPT.txt
  • CRAB-DECRYPT.txt
  • ntldr
  • NTDETECT.COM
  • Bootfont.bin

  It avoids encrypting files found in the following folders:

  • ProgramData
  • IETldCache
  • Boot
  • Program Files
  • Tor Browser
  • All Users
  • Local Settings
  • Windows
  • %Windows%
  • %AppDataLocal%
  • %Program Files%\Common Files
  • %Program Files%

  (Note: %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.. %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local on Windows Vista, 7, and 8.. %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000, Server 2003, and XP (32-bit), Vista (32-bit), 7 (32-bit), and 8 (32-bit), or C:\Program Files (x86) in Windows XP (64-bit), Vista (64-bit), 7 (64-bit), and 8 (64-bit).)

  It appends the following extension to the file name of the encrypted files:

  • .{Random}

  It drops the following file(s) as ransom note:

  • {Random}-DECRYPT.txt