Overview

overview

10

Static

static

e0462e445d...19.exe

windows7_x64

10

e0462e445d...19.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e0462e445d9d589b798f21d4e76a015266df363b25f0ca2b6b4fbf14ad103419

  • Size

    276KB

  • Sample

    210518-vl6mg7veps

  • MD5

    7d75c79a28c020fa8d11ec671ede9e31

  • SHA1

    d9dc95307df77ce75f53cd5ccba832be5feb142f

  • SHA256

    e0462e445d9d589b798f21d4e76a015266df363b25f0ca2b6b4fbf14ad103419

  • SHA512

    6d2794af2c9a489dfab0f6db0a2c0b99dc74948bcd09a8844ea18f7d79681613bec7ef978e0fcf9a62665913df8d68bbd8b830db5ad76e1ecb3cedd4c1f465aa

Score
10/10
gandcrabbackdoorpersistenceransomware

Malware Config

Targets

    • Target

      e0462e445d9d589b798f21d4e76a015266df363b25f0ca2b6b4fbf14ad103419

    • Size

      276KB

    • MD5

      7d75c79a28c020fa8d11ec671ede9e31

    • SHA1

      d9dc95307df77ce75f53cd5ccba832be5feb142f

    • SHA256

      e0462e445d9d589b798f21d4e76a015266df363b25f0ca2b6b4fbf14ad103419

    • SHA512

      6d2794af2c9a489dfab0f6db0a2c0b99dc74948bcd09a8844ea18f7d79681613bec7ef978e0fcf9a62665913df8d68bbd8b830db5ad76e1ecb3cedd4c1f465aa

    Score
    10/10
    gandcrabbackdoorpersistenceransomware

    • GandCrab Payload

    • Gandcrab

      Gandcrab is a Trojan horse that encrypts files on a computer.

      ransomwarebackdoorgandcrab

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks