Overview

overview

10

Static

static

10

NEAS.2023-...JC.exe

windows7-x64

10

NEAS.2023-...JC.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    NEAS.2023-09-08_4b52a36fe3b1343be5a25274279c5b28_gandcrab_JC.exe

  • Size

    145KB

  • Sample

    231023-x5cefsfc56

  • MD5

    4b52a36fe3b1343be5a25274279c5b28

  • SHA1

    bb196d3be17119e370a236c9173eb8d9262611aa

  • SHA256

    c53c2d4b9b1a485e62313dc1f1e417863b9477a4bc222e8f03e661b5cb015c41

  • SHA512

    fd8fa9a34b63e59b14e2033e7fa1a87e2e6b4ba8f7a2bc905ad67b3fb0ad3ac15af44c108040d7815b5af449f5856013fbac6861c6537a851fe27e56275225cd

  • SSDEEP

    3072:6YHVHd2NCMqqDL2/mr3IdE8we0Avu5r++ygLIaagvdCjRv9OtN:6yOqqDL64vdGREz

Score
10/10
gandcrabbackdoorpersistenceransomware

Malware Config

Targets

    • Target

      NEAS.2023-09-08_4b52a36fe3b1343be5a25274279c5b28_gandcrab_JC.exe

    • Size

      145KB

    • MD5

      4b52a36fe3b1343be5a25274279c5b28

    • SHA1

      bb196d3be17119e370a236c9173eb8d9262611aa

    • SHA256

      c53c2d4b9b1a485e62313dc1f1e417863b9477a4bc222e8f03e661b5cb015c41

    • SHA512

      fd8fa9a34b63e59b14e2033e7fa1a87e2e6b4ba8f7a2bc905ad67b3fb0ad3ac15af44c108040d7815b5af449f5856013fbac6861c6537a851fe27e56275225cd

    • SSDEEP

      3072:6YHVHd2NCMqqDL2/mr3IdE8we0Avu5r++ygLIaagvdCjRv9OtN:6yOqqDL64vdGREz

    Score
    10/10
    gandcrabbackdoorpersistenceransomware

    • GandCrab payload

    • Gandcrab

      Gandcrab is a Trojan horse that encrypts files on a computer.

      ransomwarebackdoorgandcrab

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks