Overview

overview

10

Static

static

3

GandCrab.exe

windows7-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    GandCrab.bin.zip

  • Size

    82KB

  • Sample

    230916-lt45jsce37

  • MD5

    88414e88eaee1ee13e057c307949cf73

  • SHA1

    84a99b92d6d4b7e700f36509550d68b507445026

  • SHA256

    390dba7c1ccbea39d9ea7d8862e2ea12aa5d833b9568077444d5dbfef7df9564

  • SHA512

    d207d8af1fd988c16d589eceb329bd4d6443e7fd2f63e00600abd27e5c703fd48fee7d5d2f7dbb858f154926ecd7d47ba6d3741c82cbae999d4fe999158be917

  • SSDEEP

    1536:Wk4BhB92ko4rhQESs+oCeh8cLRFxEvwaCVFJfnaoKKOq1xLcrSIJNtCSLS6t00:WkKr93Ghs+oCK8cLrXntZxLbIJjCSL7d

Score
10/10
gandcrabbackdoorpersistenceransomware

Malware Config

Targets

    • Target

      GandCrab.bin

    • Size

      124KB

    • MD5

      a635d6a35c2fc054042b6868ef52a0c3

    • SHA1

      a6d41275384207d250322ab8bc22ca7559ffa9c9

    • SHA256

      643f8043c0b0f89cedbfc3177ab7cfe99a8e2c7fe16691f3d54fb18bc14b8f45

    • SHA512

      ab943bdc53c95dbe2cd32958de712b5836101bf125abef86c27abc27bdce9346542867fc686feb2e23a4007888bb413871924f9a0a08d5706cf5034982db27ee

    • SSDEEP

      3072:io/ZKgm+JiNOeHtOkrEY+KT/Hfi2CXgJ:iow3NOePIY+QyBX

    Score
    10/10
    gandcrabbackdoorpersistenceransomware

    • GandCrab payload

    • Gandcrab

      Gandcrab is a Trojan horse that encrypts files on a computer.

      ransomwarebackdoorgandcrab

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

3
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks