General

  • Target

    02a54c7fa71124153228984035e09a4e27722d91c5c3550bbaedc875d5d0545e

  • Size

    248KB

  • Sample

    210518-2v13jmjh92

  • MD5

    daf11374e14ad08fe6ffd9e8d92876f2

  • SHA1

    7244e8a45c91e16abf122eb566651b01cebe20a0

  • SHA256

    02a54c7fa71124153228984035e09a4e27722d91c5c3550bbaedc875d5d0545e

  • SHA512

    fe9d938e0ca22ea5ace708a1931437b20ecfa9614b0de27432b2192dc820196045e2aa7d0f161a649b15547537d596b2c412d9bc9269774d535f8795c670fd6c

Malware Config

Targets

    • Target

      02a54c7fa71124153228984035e09a4e27722d91c5c3550bbaedc875d5d0545e

    • Size

      248KB

    • MD5

      daf11374e14ad08fe6ffd9e8d92876f2

    • SHA1

      7244e8a45c91e16abf122eb566651b01cebe20a0

    • SHA256

      02a54c7fa71124153228984035e09a4e27722d91c5c3550bbaedc875d5d0545e

    • SHA512

      fe9d938e0ca22ea5ace708a1931437b20ecfa9614b0de27432b2192dc820196045e2aa7d0f161a649b15547537d596b2c412d9bc9269774d535f8795c670fd6c

    • GandCrab Payload

    • Gandcrab

      Gandcrab is a Trojan horse that encrypts files on a computer.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Tasks