General

  • Target

    ebf203ea4348c25bfd167272597cb5c5bf39a1692efb0d442a18563b41327afc

  • Size

    331KB

  • Sample

    210518-jfc39pzcyj

  • MD5

    061e4dbb95edd3b5abce65d32723dfa4

  • SHA1

    5cbfa28c208d7fbc20c9dfcc86331d4aaadb5317

  • SHA256

    ebf203ea4348c25bfd167272597cb5c5bf39a1692efb0d442a18563b41327afc

  • SHA512

    746baf7cc54d30d2b13de579a81e1b2de433e9fd096bb61bf0412d8b46c0de06cb07c5a7b614e15c08558d33e0972399bda61ae3d84e7eaf04f6fc6351e7e803

Malware Config

Targets

    • Target

      ebf203ea4348c25bfd167272597cb5c5bf39a1692efb0d442a18563b41327afc

    • Size

      331KB

    • MD5

      061e4dbb95edd3b5abce65d32723dfa4

    • SHA1

      5cbfa28c208d7fbc20c9dfcc86331d4aaadb5317

    • SHA256

      ebf203ea4348c25bfd167272597cb5c5bf39a1692efb0d442a18563b41327afc

    • SHA512

      746baf7cc54d30d2b13de579a81e1b2de433e9fd096bb61bf0412d8b46c0de06cb07c5a7b614e15c08558d33e0972399bda61ae3d84e7eaf04f6fc6351e7e803

    • GandCrab Payload

    • Gandcrab

      Gandcrab is a Trojan horse that encrypts files on a computer.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Tasks