Overview

overview

10

Static

static

36fdeb2abf...15.exe

windows7_x64

10

36fdeb2abf...15.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    36fdeb2abf80269259078d51391f9fcf224f262107bc0d6194e37dd021237b15

  • Size

    313KB

  • Sample

    220626-a5mtvsafar

  • MD5

    541aa6e73a72f2b169163c4f167ce653

  • SHA1

    380e38fb4a4c56cbaa5c14a26ec433ce56691414

  • SHA256

    36fdeb2abf80269259078d51391f9fcf224f262107bc0d6194e37dd021237b15

  • SHA512

    c0db6d75d14c8237c1631e2d1620f5125c2e8ac8d902c778d4b36d78e6824d895642f49e5bb904fbec92352df454f91e49b437f90af2d4625e0aa4d6576d47aa

Score
10/10
gandcrabbackdoorpersistenceransomwaresuricata

Malware Config

Targets

    • Target

      36fdeb2abf80269259078d51391f9fcf224f262107bc0d6194e37dd021237b15

    • Size

      313KB

    • MD5

      541aa6e73a72f2b169163c4f167ce653

    • SHA1

      380e38fb4a4c56cbaa5c14a26ec433ce56691414

    • SHA256

      36fdeb2abf80269259078d51391f9fcf224f262107bc0d6194e37dd021237b15

    • SHA512

      c0db6d75d14c8237c1631e2d1620f5125c2e8ac8d902c778d4b36d78e6824d895642f49e5bb904fbec92352df454f91e49b437f90af2d4625e0aa4d6576d47aa

    Score
    10/10
    gandcrabbackdoorpersistenceransomwaresuricata

    • GandCrab Payload

    • Gandcrab

      Gandcrab is a Trojan horse that encrypts files on a computer.

      ransomwarebackdoorgandcrab

    • suricata: ET MALWARE Observed GandCrab Ransomware Domain (carder .bit in DNS Lookup)

      suricata: ET MALWARE Observed GandCrab Ransomware Domain (carder .bit in DNS Lookup)

      suricata

    • suricata: ET MALWARE Observed GandCrab Ransomware Domain (ransomware .bit in DNS Lookup)

      suricata: ET MALWARE Observed GandCrab Ransomware Domain (ransomware .bit in DNS Lookup)

      suricata

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks