General

  • Target

    2024-03-24_d90fe29b3f41a53120b64bb97bca37dd_karagany_mafia

  • Size

    250KB

  • Sample

    240324-hpxm5adc6x

  • MD5

    d90fe29b3f41a53120b64bb97bca37dd

  • SHA1

    e23cb30f307cab0f032a17a122e4aeaedd5c50de

  • SHA256

    335975c9240347c304af2ecec6abda1442cc418d8a043c17668b363aec8ce6f8

  • SHA512

    fca6f9a68d1dafa3e904d1e15260832374095bd2362aec74ad19d381593f1cbf61677fece983f058d8d8c922bf2ca3be834e240d665f1379b90ecc78d4fc84f7

  • SSDEEP

    6144:M+YrOIBjaklexBgiJ8sTSIkIpxIp8mDtfPBRwasxXq:kOCjaklYgVIpxIhDtR

Malware Config

Targets

    • Target

      2024-03-24_d90fe29b3f41a53120b64bb97bca37dd_karagany_mafia

    • Size

      250KB

    • MD5

      d90fe29b3f41a53120b64bb97bca37dd

    • SHA1

      e23cb30f307cab0f032a17a122e4aeaedd5c50de

    • SHA256

      335975c9240347c304af2ecec6abda1442cc418d8a043c17668b363aec8ce6f8

    • SHA512

      fca6f9a68d1dafa3e904d1e15260832374095bd2362aec74ad19d381593f1cbf61677fece983f058d8d8c922bf2ca3be834e240d665f1379b90ecc78d4fc84f7

    • SSDEEP

      6144:M+YrOIBjaklexBgiJ8sTSIkIpxIp8mDtfPBRwasxXq:kOCjaklYgVIpxIhDtR

    • GandCrab payload

    • Gandcrab

      Gandcrab is a Trojan horse that encrypts files on a computer.

    • Detects Reflective DLL injection artifacts

    • Detects ransomware indicator

    • Gandcrab Payload

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Enterprise v15

Tasks