Overview

overview

10

Static

static

3

7c59dbbc98...ex.exe

windows7-x64

10

7c59dbbc98...ex.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    7c59dbbc982cafexeexeexeex.exe

  • Size

    308KB

  • Sample

    230708-y9zafsaa77

  • MD5

    7c59dbbc982caf60c83a3bdd33adba47

  • SHA1

    6e1856c04f33343825814525c2b7dfcace1ac6e7

  • SHA256

    05a3a777df1d4adfc12e4ea48124beaa1bf96d98c50da25769d6d0f01eb3440f

  • SHA512

    243bee569bd2bd56d0f2f212433bdc956d241b8fb845a58fa8d0db8b920f6476a046fd05b285fe23732c68870ab35788a87e7e1b40273227017da645649d2d31

  • SSDEEP

    6144:ZzL7ShWDLVzVNam6GxI29dqG3KdYAYqTuPZp:nDHNam62ZdKmZmuPH

Score
10/10
gandcrabbackdoorpersistenceransomware

Malware Config

Targets

    • Target

      7c59dbbc982cafexeexeexeex.exe

    • Size

      308KB

    • MD5

      7c59dbbc982caf60c83a3bdd33adba47

    • SHA1

      6e1856c04f33343825814525c2b7dfcace1ac6e7

    • SHA256

      05a3a777df1d4adfc12e4ea48124beaa1bf96d98c50da25769d6d0f01eb3440f

    • SHA512

      243bee569bd2bd56d0f2f212433bdc956d241b8fb845a58fa8d0db8b920f6476a046fd05b285fe23732c68870ab35788a87e7e1b40273227017da645649d2d31

    • SSDEEP

      6144:ZzL7ShWDLVzVNam6GxI29dqG3KdYAYqTuPZp:nDHNam62ZdKmZmuPH

    Score
    10/10
    gandcrabbackdoorpersistenceransomware

    • GandCrab payload

    • Gandcrab

      Gandcrab is a Trojan horse that encrypts files on a computer.

      ransomwarebackdoorgandcrab

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks