Overview

overview

10

Static

static

35f91fc5ee...37.exe

windows7_x64

10

35f91fc5ee...37.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    35f91fc5eef67c4fcd843c9d2351f770d09c5ec4b4efc10ded35de84cfcb7437

  • Size

    258KB

  • Sample

    210518-qaefw3cqp2

  • MD5

    865f9e9a157c088e9f0a0c2a9c372e90

  • SHA1

    e893fe8942e7d9eb136fc21ee9800e58dda39851

  • SHA256

    35f91fc5eef67c4fcd843c9d2351f770d09c5ec4b4efc10ded35de84cfcb7437

  • SHA512

    e97968838b7969fd481fb9ba78e079f7d47133f1d15afdaa1890b7c21ace2504f3b43fff7149a42ffa186838fe0112a07d2b1f82fda00490da1010d024d70548

Score
10/10
gandcrabbackdoorpersistenceransomware

Malware Config

Targets

    • Target

      35f91fc5eef67c4fcd843c9d2351f770d09c5ec4b4efc10ded35de84cfcb7437

    • Size

      258KB

    • MD5

      865f9e9a157c088e9f0a0c2a9c372e90

    • SHA1

      e893fe8942e7d9eb136fc21ee9800e58dda39851

    • SHA256

      35f91fc5eef67c4fcd843c9d2351f770d09c5ec4b4efc10ded35de84cfcb7437

    • SHA512

      e97968838b7969fd481fb9ba78e079f7d47133f1d15afdaa1890b7c21ace2504f3b43fff7149a42ffa186838fe0112a07d2b1f82fda00490da1010d024d70548

    Score
    10/10
    gandcrabbackdoorpersistenceransomware

    • GandCrab Payload

    • Gandcrab

      Gandcrab is a Trojan horse that encrypts files on a computer.

      ransomwarebackdoorgandcrab

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks