Gandcrab

MITRE ATT&CK does not currently catalogue Gandcrab, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v19.2. Confidence: low. Treat it as orientation, not attribution.

1. T1059.001 PowerShell Execution

   What they do: gandcrab uses PowerShell scripts to execute malicious commands during initial compromise.

   What that means: Adversaries may abuse PowerShell commands and scripts for execution.

2. T1547.001 Registry Run Keys / Startup Folder PersistencePrivilege Escalation

   What they do: gandcrab establishes persistence by writing malicious entries into Windows Registry Run Keys.

   What that means: Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key.

3. T1685 Disable or Modify Tools Defense Impairment

   What they do: gandcrab disables antivirus tools by modifying system processes and service configurations.

   What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.

4. T1070.004 File Deletion Stealth

   What they do: gandcrab deletes Volume Shadow Copies and backup files via command-line utilities to prevent recovery.

   What that means: Adversaries may delete files left behind by the actions of their intrusion activity.

5. T1480 Execution Guardrails Stealth

   What they do: gandcrab masks its activity by hiding malicious processes and altering system behavior to evade detection.

   What that means: Adversaries may use execution guardrails to constrain execution or actions based on adversary supplied and environment specific conditions that are expected to be present on the target.

6. T1057 Process Discovery Discovery

   What they do: gandcrab discovers running processes using native API calls to identify targets for encryption.

   What that means: Adversaries may attempt to get information about running processes on a system.

7. T1486 Data Encrypted for Impact Impact

   What they do: gandcrab encrypts victim files using a custom ransomware payload to hold data hostage.

   What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.

8. T1489 Service Stop Impact

   What they do: gandcrab stops critical Windows services via command execution to disrupt system recovery.

   What that means: Adversaries may stop or disable services on a system to render those services unavailable to legitimate users.

The note this group leaves on a compromised machine. Click a filename to read it.

��---=    GANDCRAB V5.0.4  =--- 


***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************


	*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****


Attention! 


All your files, documents, photos, databases and other important files are encrypted and have the extension: .RFNCW        


The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files.


The server with your key is in a closed network TOR. You can get there by the following ways:


----------------------------------------------------------------------------------------


| 0. Download Tor browser - https://www.torproject.org/ 


| 1. Install Tor browser 

| 2. Open Tor Browser 

| 3. Open link in TOR browser:   http://gandcrabmfe6mnef.onion/f58deb0566e9eb5c                        

| 4. Follow the instructions on this page 


----------------------------------------------------------------------------------------                    

    


On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. 


ATTENTION!


IN ORDER TO PREVENT DATA DAMAGE:


* DO NOT MODIFY ENCRYPTED FILES

* DO NOT CHANGE DATA BELOW


---BEGIN GANDCRAB KEY---

[snip]

---END GANDCRAB KEY---


---BEGIN PC DATA---

[snip]

---END PC DATA---

---= GANDCRAB V4  =--- 


Attention! 

All your files, documents, photos, databases and other important files are encrypted and have the extension: .KRAB 

The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files.


The server with your key is in a closed network TOR. You can get there by the following ways:

----------------------------------------------------------------------------------------

| 0. Download Tor browser - https://www.torproject.org/ 

| 1. Install Tor browser 
| 2. Open Tor Browser 
| 3. Open link in TOR browser:   http://gandcrabmfe6mnef.onion/[snip]                        
| 4. Follow the instructions on this page 

----------------------------------------------------------------------------------------                    
    

On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. 


ATTENTION!

IN ORDER TO PREVENT DATA DAMAGE:

* DO NOT MODIFY ENCRYPTED FILES
* DO NOT CHANGE DATA BELOW

---BEGIN GANDCRAB KEY---
[snip]
---END GANDCRAB KEY---

---BEGIN PC DATA---
[snip]
---END PC DATA---

Ransom-note text from RansomLook, licensed CC BY 4.0.