Description
Gandcrab is a Trojan horse that encrypts files on a computer.
tracking_number.pdf.exe
General
Target
Size
Sample
tracking_number.pdf.exe
214KB
210627-jwgl78d6p6
Score
10 /10
MD5
SHA1
SHA256
SHA512
b4fc1596157eb7b7900dd1da72c301c4
e0c4095c71475036bd79f8bb926fcb575d446d36
0452a7ada10bdeda0eb905da0549955f9ce8486ff7cf76a51d73f90a90e89aad
6a7f72c23344c128dc1d7c25942affedd7c36960da229caebee274c395013d07db9bcb77a24f8cf00e765cbbd1d346cb925dc67a63ac9da2c3621c49c1c1cf48
Malware Config
Targets
Target
MD5
Filesize
tracking_number.pdf.exe
b4fc1596157eb7b7900dd1da72c301c4
214KB
Score
10/10
SHA1
SHA256
SHA512
e0c4095c71475036bd79f8bb926fcb575d446d36
0452a7ada10bdeda0eb905da0549955f9ce8486ff7cf76a51d73f90a90e89aad
6a7f72c23344c128dc1d7c25942affedd7c36960da229caebee274c395013d07db9bcb77a24f8cf00e765cbbd1d346cb925dc67a63ac9da2c3621c49c1c1cf48
Tags
Signatures
-
GandCrab Payload
-
Gandcrab
-
Adds Run key to start application
Tags
TTPs
-
Enumerates connected drives
Description
Attempts to read the root path of hard drives other than the default C: drive.
TTPs
Related Tasks
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Tasks