Overview

overview

10

Static

static

3

20240106d0...ia.exe

windows7-x64

10

20240106d0...ia.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    20240106d0b354ab8677744c68a2e1f4f317fee0karaganymafia.exe

  • Size

    308KB

  • Sample

    240107-x9n9tacfbq

  • MD5

    d0b354ab8677744c68a2e1f4f317fee0

  • SHA1

    7e54300fda71e614b1a137dcc8cd7fd6b6e88242

  • SHA256

    e7c8b631d08b694cee5323231b48985f56f2abe0909cb448329f1d7bf58069db

  • SHA512

    b99d531ea6971fcd721f85c336461f4a9b06ccb3d58fcccce840384e2907dd40daf9d30e35d602f0a2301c88e88faaf5f45af66598dcbbbb636d58343c7c3a8e

  • SSDEEP

    6144:QzL7ShWDLVzVNam6GxI29dqG3KdYAYqTuPZp:2DHNam62ZdKmZmuPH

Score
10/10
gandcrabbackdoorpersistenceransomware

Malware Config

Targets

    • Target

      20240106d0b354ab8677744c68a2e1f4f317fee0karaganymafia.exe

    • Size

      308KB

    • MD5

      d0b354ab8677744c68a2e1f4f317fee0

    • SHA1

      7e54300fda71e614b1a137dcc8cd7fd6b6e88242

    • SHA256

      e7c8b631d08b694cee5323231b48985f56f2abe0909cb448329f1d7bf58069db

    • SHA512

      b99d531ea6971fcd721f85c336461f4a9b06ccb3d58fcccce840384e2907dd40daf9d30e35d602f0a2301c88e88faaf5f45af66598dcbbbb636d58343c7c3a8e

    • SSDEEP

      6144:QzL7ShWDLVzVNam6GxI29dqG3KdYAYqTuPZp:2DHNam62ZdKmZmuPH

    Score
    10/10
    gandcrabbackdoorpersistenceransomware

    • GandCrab payload

    • Gandcrab

      Gandcrab is a Trojan horse that encrypts files on a computer.

      ransomwarebackdoorgandcrab

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks