Overview

overview

10

Static

static

3

f3242408ca...JC.exe

windows7-x64

10

f3242408ca...JC.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f3242408ca12d9bbae7c71262c1718fa_mafia_JC.exe

  • Size

    250KB

  • Sample

    230831-tcesbsfg5t

  • MD5

    f3242408ca12d9bbae7c71262c1718fa

  • SHA1

    91b1ad23b3859844eb31fe6addee5e2fce9bd410

  • SHA256

    f5c393593a63c7bf6500b60fac861a1cabbf3d66ed4a856fddc0cd4ac9638d63

  • SHA512

    5aa46f9376b22124676f2aea11ec827ba9102a58041b1d14ff96d4cab51ac64e208aa794a202f6ec9fcb7e7bd8e2497b26303c5bf95973d0fdab07d034fd0619

  • SSDEEP

    6144:Aa1G8FVA6adURuvqdo1NGKXmhYvWVQMBCXaFhWzAJY:nFG6adUQcu8Ykv2aFhUR

Score
10/10
gandcrabbackdoorpersistenceransomware

Malware Config

Targets

    • Target

      f3242408ca12d9bbae7c71262c1718fa_mafia_JC.exe

    • Size

      250KB

    • MD5

      f3242408ca12d9bbae7c71262c1718fa

    • SHA1

      91b1ad23b3859844eb31fe6addee5e2fce9bd410

    • SHA256

      f5c393593a63c7bf6500b60fac861a1cabbf3d66ed4a856fddc0cd4ac9638d63

    • SHA512

      5aa46f9376b22124676f2aea11ec827ba9102a58041b1d14ff96d4cab51ac64e208aa794a202f6ec9fcb7e7bd8e2497b26303c5bf95973d0fdab07d034fd0619

    • SSDEEP

      6144:Aa1G8FVA6adURuvqdo1NGKXmhYvWVQMBCXaFhWzAJY:nFG6adUQcu8Ykv2aFhUR

    Score
    10/10
    gandcrabbackdoorpersistenceransomware

    • GandCrab payload

    • Gandcrab

      Gandcrab is a Trojan horse that encrypts files on a computer.

      ransomwarebackdoorgandcrab

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks