Overview

overview

10

Static

static

3

NEAS.2023-...JC.exe

windows7-x64

10

NEAS.2023-...JC.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    NEAS.2023-09-06_c71c2f157263582f3c309964eba9c3eb_gandcrab_JC.exe

  • Size

    170KB

  • Sample

    231023-ypxk5aec3v

  • MD5

    c71c2f157263582f3c309964eba9c3eb

  • SHA1

    69e0931306b4372ecf0af62db0d507ed3de017bb

  • SHA256

    89001b29d518ee1f49fcf96169e8f8f52b47c22ed44a52fd5dfd30bd952e6938

  • SHA512

    12717ff4cc1a4b286e0ad9f464eb9a69bb13a99ffa31deab8e09141629e7ea47422b63aacf8d8cb925bd98a94daf79418803433a5e53ece282d210d809457bcc

  • SSDEEP

    3072:URPI6YetSOYyM1PUVDAWpcB3/Az/O9xn6Ln+q7E/kfTOQ5N:URNYmSlPdOO3/Y/Wyh7B7OQn

Score
10/10
gandcrabbackdoorpersistenceransomware

Malware Config

Targets

    • Target

      NEAS.2023-09-06_c71c2f157263582f3c309964eba9c3eb_gandcrab_JC.exe

    • Size

      170KB

    • MD5

      c71c2f157263582f3c309964eba9c3eb

    • SHA1

      69e0931306b4372ecf0af62db0d507ed3de017bb

    • SHA256

      89001b29d518ee1f49fcf96169e8f8f52b47c22ed44a52fd5dfd30bd952e6938

    • SHA512

      12717ff4cc1a4b286e0ad9f464eb9a69bb13a99ffa31deab8e09141629e7ea47422b63aacf8d8cb925bd98a94daf79418803433a5e53ece282d210d809457bcc

    • SSDEEP

      3072:URPI6YetSOYyM1PUVDAWpcB3/Az/O9xn6Ln+q7E/kfTOQ5N:URNYmSlPdOO3/Y/Wyh7B7OQn

    Score
    10/10
    gandcrabbackdoorpersistenceransomware

    • GandCrab payload

    • Gandcrab

      Gandcrab is a Trojan horse that encrypts files on a computer.

      ransomwarebackdoorgandcrab

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks