Overview

overview

10

Static

static

41c35a69a2...df.exe

windows7_x64

10

41c35a69a2...df.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    41c35a69a2313fec2dbf6b2ba8813a5e3ee3adf6a48491ca2b7b9a0110e54adf

  • Size

    231KB

  • Sample

    220708-fbdxrabhd8

  • MD5

    1d364a0c31c32d46b5efe2598125818f

  • SHA1

    11404f54bd4a3168a152b9af177f13bc481fa576

  • SHA256

    41c35a69a2313fec2dbf6b2ba8813a5e3ee3adf6a48491ca2b7b9a0110e54adf

  • SHA512

    3e39a071666b0f6c00c86a445e401898b22bf2de99e8c632a89032364620acef8bc016dce0bd522172421f1b97197ef7e673c4e840b41c37ca4a029753c82fe8

Score
10/10
gandcrabbackdoorpersistenceransomwaresuricata

Malware Config

Targets

    • Target

      41c35a69a2313fec2dbf6b2ba8813a5e3ee3adf6a48491ca2b7b9a0110e54adf

    • Size

      231KB

    • MD5

      1d364a0c31c32d46b5efe2598125818f

    • SHA1

      11404f54bd4a3168a152b9af177f13bc481fa576

    • SHA256

      41c35a69a2313fec2dbf6b2ba8813a5e3ee3adf6a48491ca2b7b9a0110e54adf

    • SHA512

      3e39a071666b0f6c00c86a445e401898b22bf2de99e8c632a89032364620acef8bc016dce0bd522172421f1b97197ef7e673c4e840b41c37ca4a029753c82fe8

    Score
    10/10
    gandcrabbackdoorpersistenceransomwaresuricata

    • GandCrab payload

    • Gandcrab

      Gandcrab is a Trojan horse that encrypts files on a computer.

      ransomwarebackdoorgandcrab

    • suricata: ET MALWARE Observed GandCrab Ransomware Domain (carder .bit in DNS Lookup)

      suricata: ET MALWARE Observed GandCrab Ransomware Domain (carder .bit in DNS Lookup)

      suricata

    • suricata: ET MALWARE Observed GandCrab Ransomware Domain (ransomware .bit in DNS Lookup)

      suricata: ET MALWARE Observed GandCrab Ransomware Domain (ransomware .bit in DNS Lookup)

      suricata

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

3
T1012

Peripheral Device Discovery

2
T1120

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks