Overview

overview

10

Static

static

77b17afee1...1b.exe

windows7_x64

10

77b17afee1...1b.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    77b17afee1a4e6cd6e35aaae1faf78767dc700a6975545724e893972aab3eb1b

  • Size

    276KB

  • Sample

    210518-kn3k3vq6cs

  • MD5

    09f85d8427099864e2164c92bca8838b

  • SHA1

    620b754a978e024125adf9b7d002cc03dfe18477

  • SHA256

    77b17afee1a4e6cd6e35aaae1faf78767dc700a6975545724e893972aab3eb1b

  • SHA512

    4c99f75d699fdaa056eb3e141a6b768e73e2df80f2b54e5121d633ebf882b5150ed611ed18f7e39891d6fa166294db64409a9098a229b8302297f6e6ec1a4c67

Score
10/10
gandcrabbackdoorpersistenceransomware

Malware Config

Targets

    • Target

      77b17afee1a4e6cd6e35aaae1faf78767dc700a6975545724e893972aab3eb1b

    • Size

      276KB

    • MD5

      09f85d8427099864e2164c92bca8838b

    • SHA1

      620b754a978e024125adf9b7d002cc03dfe18477

    • SHA256

      77b17afee1a4e6cd6e35aaae1faf78767dc700a6975545724e893972aab3eb1b

    • SHA512

      4c99f75d699fdaa056eb3e141a6b768e73e2df80f2b54e5121d633ebf882b5150ed611ed18f7e39891d6fa166294db64409a9098a229b8302297f6e6ec1a4c67

    Score
    10/10
    gandcrabbackdoorpersistenceransomware

    • GandCrab Payload

    • Gandcrab

      Gandcrab is a Trojan horse that encrypts files on a computer.

      ransomwarebackdoorgandcrab

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks