Overview

overview

10

Static

static

3

NEAS.2023-...JC.exe

windows7-x64

10

NEAS.2023-...JC.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    NEAS.2023-09-07_efc07d94ddff32b4f3b4dc0064d44dce_mafia_JC.exe

  • Size

    255KB

  • Sample

    231023-x1drqafb35

  • MD5

    efc07d94ddff32b4f3b4dc0064d44dce

  • SHA1

    e7e646e0be7b4ecf76e230e92880a1091f310605

  • SHA256

    94c1981a7c83b29e95f62aa693b7e97be2f40d1b86f02df0751568c7cb0e9a4f

  • SHA512

    3b01c2cfeb3447923d5f8b9e02da70d89f64ae0ab333e9df7011a3d9d70dc03cd1b506629b1cb41a37b1313bb55088643351286241bdc3bca63c3f6397c8fb0b

  • SSDEEP

    3072:KyR64m3uiNEib+3NlcpX0XEtnvJzfQcHa8fiLtPy0AV5ODgnVqTLA4OmsWF:JH6Gh3vK0XEtJDHhfyylODgnMo4nsM

Score
10/10
gandcrabbackdoorpersistenceransomware

Malware Config

Targets

    • Target

      NEAS.2023-09-07_efc07d94ddff32b4f3b4dc0064d44dce_mafia_JC.exe

    • Size

      255KB

    • MD5

      efc07d94ddff32b4f3b4dc0064d44dce

    • SHA1

      e7e646e0be7b4ecf76e230e92880a1091f310605

    • SHA256

      94c1981a7c83b29e95f62aa693b7e97be2f40d1b86f02df0751568c7cb0e9a4f

    • SHA512

      3b01c2cfeb3447923d5f8b9e02da70d89f64ae0ab333e9df7011a3d9d70dc03cd1b506629b1cb41a37b1313bb55088643351286241bdc3bca63c3f6397c8fb0b

    • SSDEEP

      3072:KyR64m3uiNEib+3NlcpX0XEtnvJzfQcHa8fiLtPy0AV5ODgnVqTLA4OmsWF:JH6Gh3vK0XEtJDHhfyylODgnMo4nsM

    Score
    10/10
    gandcrabbackdoorpersistenceransomware

    • GandCrab payload

    • Gandcrab

      Gandcrab is a Trojan horse that encrypts files on a computer.

      ransomwarebackdoorgandcrab

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks