Overview

overview

10

Static

static

3

505ff16c6c...JC.exe

windows7-x64

10

505ff16c6c...JC.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    505ff16c6c13d479eb283381b9b97a90_mafia_JC.exe

  • Size

    324KB

  • Sample

    230820-mhrkragb81

  • MD5

    505ff16c6c13d479eb283381b9b97a90

  • SHA1

    9b0ee41c99e8f7181b9d91e96190ca3ca79200fe

  • SHA256

    607ea9f2f61d9a83208d20bf37fb2be48e8fe989ed69aad1f6479cc9aa494538

  • SHA512

    099975bfa7c343a07fcbbf3b02e7678ed1c65917ce384b1879f7ae0385de90694abae47e412beefb44a3d40ee262336f11a260c10b0dc08f14d758349cf3891f

  • SSDEEP

    6144:qRD8GPgklslrAaL3Uc2wNL9EFra+iYBVsBNjk1+pb:qRdgk0rMLvL+NXJ

Score
10/10
gandcrabbackdoorpersistenceransomware

Malware Config

Targets

    • Target

      505ff16c6c13d479eb283381b9b97a90_mafia_JC.exe

    • Size

      324KB

    • MD5

      505ff16c6c13d479eb283381b9b97a90

    • SHA1

      9b0ee41c99e8f7181b9d91e96190ca3ca79200fe

    • SHA256

      607ea9f2f61d9a83208d20bf37fb2be48e8fe989ed69aad1f6479cc9aa494538

    • SHA512

      099975bfa7c343a07fcbbf3b02e7678ed1c65917ce384b1879f7ae0385de90694abae47e412beefb44a3d40ee262336f11a260c10b0dc08f14d758349cf3891f

    • SSDEEP

      6144:qRD8GPgklslrAaL3Uc2wNL9EFra+iYBVsBNjk1+pb:qRdgk0rMLvL+NXJ

    Score
    10/10
    gandcrabbackdoorpersistenceransomware

    • GandCrab payload

    • Gandcrab

      Gandcrab is a Trojan horse that encrypts files on a computer.

      ransomwarebackdoorgandcrab

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks