Overview

overview

10

Static

static

3

2024-01-19...ia.exe

windows7-x64

10

2024-01-19...ia.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-01-19_6c97340832ad95a04bd469b76417d107_karagany_mafia

  • Size

    308KB

  • Sample

    240119-kp361sbbg9

  • MD5

    6c97340832ad95a04bd469b76417d107

  • SHA1

    c1e9942ce39fff1aa8b6a4198397473236d58c19

  • SHA256

    068351ddab541af525960f114de53a536701b392362eec9a0c6afbd60c9c59d1

  • SHA512

    b1b1bc50381f9517106b1e474de5a4f189420049893134840558c26f013ed4e69a29f6cbffce9d289acabf09c743a9f2d5c22a58f8f20e7e831f5d11cf9e6850

  • SSDEEP

    6144:CzL7ShWDLVzVNam6GxI29dqG3KdYAYqTuPZp:IDHNam62ZdKmZmuPH

Score
10/10
gandcrabbackdoorpersistenceransomware

Malware Config

Targets

    • Target

      2024-01-19_6c97340832ad95a04bd469b76417d107_karagany_mafia

    • Size

      308KB

    • MD5

      6c97340832ad95a04bd469b76417d107

    • SHA1

      c1e9942ce39fff1aa8b6a4198397473236d58c19

    • SHA256

      068351ddab541af525960f114de53a536701b392362eec9a0c6afbd60c9c59d1

    • SHA512

      b1b1bc50381f9517106b1e474de5a4f189420049893134840558c26f013ed4e69a29f6cbffce9d289acabf09c743a9f2d5c22a58f8f20e7e831f5d11cf9e6850

    • SSDEEP

      6144:CzL7ShWDLVzVNam6GxI29dqG3KdYAYqTuPZp:IDHNam62ZdKmZmuPH

    Score
    10/10
    gandcrabbackdoorpersistenceransomware

    • GandCrab payload

    • Gandcrab

      Gandcrab is a Trojan horse that encrypts files on a computer.

      ransomwarebackdoorgandcrab

    • Detects Reflective DLL injection artifacts

    • Detects ransomware indicator

    • Gandcrab Payload

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks