Overview

overview

10

Static

static

3

2024-02-25...ia.exe

windows7-x64

10

2024-02-25...ia.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-02-25_6d39595e01e890e825e7682fb3f84faf_karagany_mafia

  • Size

    308KB

  • Sample

    240225-x9afnaae33

  • MD5

    6d39595e01e890e825e7682fb3f84faf

  • SHA1

    7b84c4eb9b41fb626d05d4e0ea5551367edb5207

  • SHA256

    8d5541cb52e722e3c40bb0d6a5345d0ad92b21074eb4e6a7a69a060771b51d7e

  • SHA512

    a2b2e5570940edc4b2f13cbed4467b34fb208e1aea8b9ed41ff9336938bbe8dd89da1be2875d1b592fc6b3cb3cdd1e27fc88856d0a1463e04aba7f90df49d06f

  • SSDEEP

    6144:mzL7ShWDLVzVNam6GxI29dqG3KdYAYqTuPZp:kDHNam62ZdKmZmuPH

Score
10/10
gandcrabbackdoorpersistenceransomware

Malware Config

Targets

    • Target

      2024-02-25_6d39595e01e890e825e7682fb3f84faf_karagany_mafia

    • Size

      308KB

    • MD5

      6d39595e01e890e825e7682fb3f84faf

    • SHA1

      7b84c4eb9b41fb626d05d4e0ea5551367edb5207

    • SHA256

      8d5541cb52e722e3c40bb0d6a5345d0ad92b21074eb4e6a7a69a060771b51d7e

    • SHA512

      a2b2e5570940edc4b2f13cbed4467b34fb208e1aea8b9ed41ff9336938bbe8dd89da1be2875d1b592fc6b3cb3cdd1e27fc88856d0a1463e04aba7f90df49d06f

    • SSDEEP

      6144:mzL7ShWDLVzVNam6GxI29dqG3KdYAYqTuPZp:kDHNam62ZdKmZmuPH

    Score
    10/10
    gandcrabbackdoorpersistenceransomware

    • GandCrab payload

    • Gandcrab

      Gandcrab is a Trojan horse that encrypts files on a computer.

      ransomwarebackdoorgandcrab

    • Detects Reflective DLL injection artifacts

    • Detects ransomware indicator

    • Gandcrab Payload

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks