General
-
Target
035ae8f389e0a4cb58428d892123bc3e3b646e4387c641e664c5552228087285
-
Size
584KB
-
Sample
220528-a3smbsagc7
-
MD5
e0e5164cf5b19d56f33520cd44875c95
-
SHA1
220f5a668dde7c6d916b1b9a5dcde82dbc2639f8
-
SHA256
035ae8f389e0a4cb58428d892123bc3e3b646e4387c641e664c5552228087285
-
SHA512
32b38257d6acf7a43aaf4e08d4d576acc2ac6a33a9858eff6628c0b54e095bcc30f4d8b11fab2f22ab649fd03aa56a069df33c3b76f39f05cb969cb9f0d0f461
Static task
static1
Behavioral task
behavioral1
Sample
035ae8f389e0a4cb58428d892123bc3e3b646e4387c641e664c5552228087285.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
035ae8f389e0a4cb58428d892123bc3e3b646e4387c641e664c5552228087285.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
C:\PGKHQNKV-DECRYPT.txt
http://gandcrabmfe6mnef.onion/ac4592bce84239f6
Extracted
C:\ZFQPHGWO-DECRYPT.txt
http://gandcrabmfe6mnef.onion/da5f2c734d8efcd1
Targets
-
-
Target
035ae8f389e0a4cb58428d892123bc3e3b646e4387c641e664c5552228087285
-
Size
584KB
-
MD5
e0e5164cf5b19d56f33520cd44875c95
-
SHA1
220f5a668dde7c6d916b1b9a5dcde82dbc2639f8
-
SHA256
035ae8f389e0a4cb58428d892123bc3e3b646e4387c641e664c5552228087285
-
SHA512
32b38257d6acf7a43aaf4e08d4d576acc2ac6a33a9858eff6628c0b54e095bcc30f4d8b11fab2f22ab649fd03aa56a069df33c3b76f39f05cb969cb9f0d0f461
Score10/10-
GandCrab Payload
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry
-