Overview

overview

10

Static

static

3

2024-03-19...ia.exe

windows7-x64

10

2024-03-19...ia.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    2024-03-19_d9075ec7ce6d3544f259819b5420858c_mafia

  • Size

    316KB

  • Sample

    240319-wjgavaad26

  • MD5

    d9075ec7ce6d3544f259819b5420858c

  • SHA1

    08f035859da40116daa108233e3755b50feb8205

  • SHA256

    c73a44d5939767f79cbfd546189879a81a2be8383b4628211e82b43dc9b4b801

  • SHA512

    ed5435ee4b1b55a483f670e2ffff9a2e90f706e3bb8786ff28922dbf0af60cf1d9f61e14f2d48c38e19c9b87317103c24b5f2fb46c2e7a14fbab799416208ab2

  • SSDEEP

    6144:QvExNMO1UnseVgkV0xwvfxnhLTiusLe1740/:fTM0Unsna5mut40/

Score
10/10
gandcrabbackdoorpersistenceransomware

Malware Config

Targets

    • Target

      2024-03-19_d9075ec7ce6d3544f259819b5420858c_mafia

    • Size

      316KB

    • MD5

      d9075ec7ce6d3544f259819b5420858c

    • SHA1

      08f035859da40116daa108233e3755b50feb8205

    • SHA256

      c73a44d5939767f79cbfd546189879a81a2be8383b4628211e82b43dc9b4b801

    • SHA512

      ed5435ee4b1b55a483f670e2ffff9a2e90f706e3bb8786ff28922dbf0af60cf1d9f61e14f2d48c38e19c9b87317103c24b5f2fb46c2e7a14fbab799416208ab2

    • SSDEEP

      6144:QvExNMO1UnseVgkV0xwvfxnhLTiusLe1740/:fTM0Unsna5mut40/

    Score
    10/10
    gandcrabbackdoorpersistenceransomware

    • GandCrab payload

    • Gandcrab

      Gandcrab is a Trojan horse that encrypts files on a computer.

      ransomwarebackdoorgandcrab

    • Detects Reflective DLL injection artifacts

    • Detects ransomware indicator

    • Gandcrab Payload

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks