General
-
Target
872bf2c276fe3242513c2ed1b254a5ab3c0dea273dde944c05b711697811753f.sample
-
Size
168KB
-
Sample
210726-aphhnh3g26
-
MD5
700a4f7ed40dd9ac29891c2ec3d4bef7
-
SHA1
1546e3bbe9eb3e6b185097226bb758d98a207429
-
SHA256
872bf2c276fe3242513c2ed1b254a5ab3c0dea273dde944c05b711697811753f
-
SHA512
1b615297f445eb4c3909e46191834450191b6e9716a83c380a02db6566dd96431f6e2271c01508d3f271af0b4fbfff31b485e1fc6bf952a4b2177aa41fb65c0a
Static task
static1
Behavioral task
behavioral1
Sample
872bf2c276fe3242513c2ed1b254a5ab3c0dea273dde944c05b711697811753f.sample.exe
Resource
win7v20210408
Malware Config
Extracted
C:\JUHXNX-DECRYPT.txt
http://gandcrabmfe6mnef.onion/daeb14a93d72fff5
Extracted
C:\GLTTL-DECRYPT.txt
http://gandcrabmfe6mnef.onion/3a1b78d9c33e49
Targets
-
-
Target
872bf2c276fe3242513c2ed1b254a5ab3c0dea273dde944c05b711697811753f.sample
-
Size
168KB
-
MD5
700a4f7ed40dd9ac29891c2ec3d4bef7
-
SHA1
1546e3bbe9eb3e6b185097226bb758d98a207429
-
SHA256
872bf2c276fe3242513c2ed1b254a5ab3c0dea273dde944c05b711697811753f
-
SHA512
1b615297f445eb4c3909e46191834450191b6e9716a83c380a02db6566dd96431f6e2271c01508d3f271af0b4fbfff31b485e1fc6bf952a4b2177aa41fb65c0a
-
suricata: ET MALWARE [eSentire] Win32/GandCrab v4/5 Ransomware CnC Activity
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry
-