General
-
Target
007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286
-
Size
139KB
-
Sample
220128-2pqz5afhb5
-
MD5
d968a6bab562d04e73a773dece109f80
-
SHA1
12e939054039c0b114f278231693a9fd1fdb1b2e
-
SHA256
007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286
-
SHA512
6e14eea3551bec5aae46535296ecab9390388bbb8f589d9d15dec3f8580bb6442ea1f791d468f806276b541972673df74b5d24d0553b03ec3274aee91e743f13
Static task
static1
Behavioral task
behavioral1
Sample
007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe
Resource
win10-en-20211208
Malware Config
Extracted
C:\CQDFAB-DECRYPT.txt
http://gandcrabmfe6mnef.onion/6b33c723348c4eb6
Extracted
C:\HTKXWWXAYM-DECRYPT.txt
http://gandcrabmfe6mnef.onion/a258e38864976688
Targets
-
-
Target
007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286
-
Size
139KB
-
MD5
d968a6bab562d04e73a773dece109f80
-
SHA1
12e939054039c0b114f278231693a9fd1fdb1b2e
-
SHA256
007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286
-
SHA512
6e14eea3551bec5aae46535296ecab9390388bbb8f589d9d15dec3f8580bb6442ea1f791d468f806276b541972673df74b5d24d0553b03ec3274aee91e743f13
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry
-