Overview

overview

10

Static

static

10

2ada878cb7...ex.exe

windows7-x64

10

2ada878cb7...ex.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2ada878cb7e27fexeexeexeex.exe

  • Size

    145KB

  • Sample

    230706-p4hababb39

  • MD5

    2ada878cb7e27fc9228ae685a20ecc58

  • SHA1

    e351add29aab22d5bd5c039f93dc3170f4645d14

  • SHA256

    df9ddf586be25318a139cc886a55e7b57b4d5348ba0385e6ec339dfc66522d80

  • SHA512

    09bb0ff0119d0d30f8611a4009388e516d92eb6b7f5f1b02a96e9038e5d6f5898ee72fbe8395f6ec9d3262f6b6824d64e985fd1159dd8279bfdfb1ffa4740144

  • SSDEEP

    3072:3YHVHd2NCMqqDL2/mr3IdE8we0Avu5r++ygLIaagvdCjRv9OtN:3yOqqDL64vdGREz

Score
10/10
gandcrabbackdoorpersistenceransomware

Malware Config

Targets

    • Target

      2ada878cb7e27fexeexeexeex.exe

    • Size

      145KB

    • MD5

      2ada878cb7e27fc9228ae685a20ecc58

    • SHA1

      e351add29aab22d5bd5c039f93dc3170f4645d14

    • SHA256

      df9ddf586be25318a139cc886a55e7b57b4d5348ba0385e6ec339dfc66522d80

    • SHA512

      09bb0ff0119d0d30f8611a4009388e516d92eb6b7f5f1b02a96e9038e5d6f5898ee72fbe8395f6ec9d3262f6b6824d64e985fd1159dd8279bfdfb1ffa4740144

    • SSDEEP

      3072:3YHVHd2NCMqqDL2/mr3IdE8we0Avu5r++ygLIaagvdCjRv9OtN:3yOqqDL64vdGREz

    Score
    10/10
    gandcrabbackdoorpersistenceransomware

    • GandCrab payload

    • Gandcrab

      Gandcrab is a Trojan horse that encrypts files on a computer.

      ransomwarebackdoorgandcrab

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks