General

  • Target

    8f6a014384f21f69d78472ba6079d6d8f695d4e3610ac373075969baaadd35f8

  • Size

    308KB

  • Sample

    240322-1nhrpabh6y

  • MD5

    be0771b985230c2c4ed0c672b19717b6

  • SHA1

    ad9b5f5998777786371eb91f2d68de2b64488c89

  • SHA256

    8f6a014384f21f69d78472ba6079d6d8f695d4e3610ac373075969baaadd35f8

  • SHA512

    a963eda0826a7a81a101cf32ac4496510e22828b3379c55bd236122ab3bbba001cf9f51fca3cc262b372d0da473d4642ede378de76483980f39b742f75682a56

  • SSDEEP

    6144:0zL7ShWDLVzVNam6GxI29dqG3KdYAYqTuPZp:CDHNam62ZdKmZmuPH

Malware Config

Targets

    • Target

      8f6a014384f21f69d78472ba6079d6d8f695d4e3610ac373075969baaadd35f8

    • Size

      308KB

    • MD5

      be0771b985230c2c4ed0c672b19717b6

    • SHA1

      ad9b5f5998777786371eb91f2d68de2b64488c89

    • SHA256

      8f6a014384f21f69d78472ba6079d6d8f695d4e3610ac373075969baaadd35f8

    • SHA512

      a963eda0826a7a81a101cf32ac4496510e22828b3379c55bd236122ab3bbba001cf9f51fca3cc262b372d0da473d4642ede378de76483980f39b742f75682a56

    • SSDEEP

      6144:0zL7ShWDLVzVNam6GxI29dqG3KdYAYqTuPZp:CDHNam62ZdKmZmuPH

    • GandCrab payload

    • Gandcrab

      Gandcrab is a Trojan horse that encrypts files on a computer.

    • Detects Reflective DLL injection artifacts

    • Detects ransomware indicator

    • Gandcrab Payload

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Enterprise v15

Tasks