General

  • Target

    f4bc9196dc7eb796af047f8655fab607d910ecfd4ba2eeadd9ea931fdda9498c

  • Size

    229KB

  • Sample

    210518-adenv6yfpe

  • MD5

    d0ad1509cda862e6c3d86a2989748003

  • SHA1

    a1d2a91ad0cb1419bfb663a67abbc340f4806eb1

  • SHA256

    f4bc9196dc7eb796af047f8655fab607d910ecfd4ba2eeadd9ea931fdda9498c

  • SHA512

    4665e360c9d369d821c9ff93173c812db6ae9297746434ad17a9f3c8f8826ae8e2c201259ccf125d1e014d7eeae0fe4ac3be309d93fe9dff8bc08de150975f09

Malware Config

Targets

    • Target

      f4bc9196dc7eb796af047f8655fab607d910ecfd4ba2eeadd9ea931fdda9498c

    • Size

      229KB

    • MD5

      d0ad1509cda862e6c3d86a2989748003

    • SHA1

      a1d2a91ad0cb1419bfb663a67abbc340f4806eb1

    • SHA256

      f4bc9196dc7eb796af047f8655fab607d910ecfd4ba2eeadd9ea931fdda9498c

    • SHA512

      4665e360c9d369d821c9ff93173c812db6ae9297746434ad17a9f3c8f8826ae8e2c201259ccf125d1e014d7eeae0fe4ac3be309d93fe9dff8bc08de150975f09

    • GandCrab Payload

    • Gandcrab

      Gandcrab is a Trojan horse that encrypts files on a computer.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Tasks