General

  • Target

    2024-03-22_bf8843963f4b873f2ed3153f96061105_gandcrab

  • Size

    145KB

  • Sample

    240322-q8btrsee61

  • MD5

    bf8843963f4b873f2ed3153f96061105

  • SHA1

    4be6aa386a6eecad7e6c1ff8380008dfdcb42049

  • SHA256

    bb16d32c59b9810234fb7eb7edf6f288369ebb9ff83ddb6398025da7fd3a44b4

  • SHA512

    9fdc1c9965682d788c580c2cee4a37a76002d6158e0315c4309336ceba0e72e156c224a12b8f882fefc68ba07982964b82615edd446407c4ec51ce42aaa5f58c

  • SSDEEP

    3072:vYHVHd2NCMqqDL2/mr3IdE8we0Avu5r++ygLIaagvdCjRv9OtN:vyOqqDL64vdGREz

Malware Config

Targets

    • Target

      2024-03-22_bf8843963f4b873f2ed3153f96061105_gandcrab

    • Size

      145KB

    • MD5

      bf8843963f4b873f2ed3153f96061105

    • SHA1

      4be6aa386a6eecad7e6c1ff8380008dfdcb42049

    • SHA256

      bb16d32c59b9810234fb7eb7edf6f288369ebb9ff83ddb6398025da7fd3a44b4

    • SHA512

      9fdc1c9965682d788c580c2cee4a37a76002d6158e0315c4309336ceba0e72e156c224a12b8f882fefc68ba07982964b82615edd446407c4ec51ce42aaa5f58c

    • SSDEEP

      3072:vYHVHd2NCMqqDL2/mr3IdE8we0Avu5r++ygLIaagvdCjRv9OtN:vyOqqDL64vdGREz

    • GandCrab payload

    • Gandcrab

      Gandcrab is a Trojan horse that encrypts files on a computer.

    • Detects ransomware indicator

    • Gandcrab Payload

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Enterprise v15

Tasks