Overview

overview

10

Static

static

3

b1e9b98882...JC.exe

windows7-x64

10

b1e9b98882...JC.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    b1e9b988825857bbe89cf7609a98fee5_mafia_JC.exe

  • Size

    300KB

  • Sample

    230827-tw8jradc7w

  • MD5

    b1e9b988825857bbe89cf7609a98fee5

  • SHA1

    3c09de91767d5ee6d98b508c365b46ef60343609

  • SHA256

    ebfdffd990657f023c9e5c9a2c2a4bfbf8a7c2d9e4e62a4fcf068d73b8db8175

  • SHA512

    55ddeb73ab288f32300168c42053cd9b7abb97fd645ce474f05c12685f5a2be8f146a94741bf5f443f7210bef0981bf7c6edec5d922044f66ab6ee3fc5520a20

  • SSDEEP

    6144:5vEANMO1UnseVgkV0xwvfxnhLTiusLe1740B:quM0Unsna5mut40B

Score
10/10
gandcrabbackdoorpersistenceransomware

Malware Config

Targets

    • Target

      b1e9b988825857bbe89cf7609a98fee5_mafia_JC.exe

    • Size

      300KB

    • MD5

      b1e9b988825857bbe89cf7609a98fee5

    • SHA1

      3c09de91767d5ee6d98b508c365b46ef60343609

    • SHA256

      ebfdffd990657f023c9e5c9a2c2a4bfbf8a7c2d9e4e62a4fcf068d73b8db8175

    • SHA512

      55ddeb73ab288f32300168c42053cd9b7abb97fd645ce474f05c12685f5a2be8f146a94741bf5f443f7210bef0981bf7c6edec5d922044f66ab6ee3fc5520a20

    • SSDEEP

      6144:5vEANMO1UnseVgkV0xwvfxnhLTiusLe1740B:quM0Unsna5mut40B

    Score
    10/10
    gandcrabbackdoorpersistenceransomware

    • GandCrab payload

    • Gandcrab

      Gandcrab is a Trojan horse that encrypts files on a computer.

      ransomwarebackdoorgandcrab

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks