General

  • Target

    2024-03-24_2263433a7b2c639022092a8d025c6182_karagany_mafia

  • Size

    308KB

  • Sample

    240324-jamp2sag79

  • MD5

    2263433a7b2c639022092a8d025c6182

  • SHA1

    8ad7b9b0d1305d6b2ddf41b5a555c3890cf6a71e

  • SHA256

    42fc796aab761e8999da980d562f38a5881aa35660006b07f8a3c20b3efa4ce4

  • SHA512

    81a1699f8f3010dfbf5c895d570642d41a705a4b1dbfd4ed5fc5687a1bf24ce504ca78e817e365071e07a875b4adaee2d8b65b9513b595f263e6c0287330b6ed

  • SSDEEP

    6144:czL7ShWDLVzVNam6GxI29dqG3KdYAYqTuPZp:qDHNam62ZdKmZmuPH

Malware Config

Targets

    • Target

      2024-03-24_2263433a7b2c639022092a8d025c6182_karagany_mafia

    • Size

      308KB

    • MD5

      2263433a7b2c639022092a8d025c6182

    • SHA1

      8ad7b9b0d1305d6b2ddf41b5a555c3890cf6a71e

    • SHA256

      42fc796aab761e8999da980d562f38a5881aa35660006b07f8a3c20b3efa4ce4

    • SHA512

      81a1699f8f3010dfbf5c895d570642d41a705a4b1dbfd4ed5fc5687a1bf24ce504ca78e817e365071e07a875b4adaee2d8b65b9513b595f263e6c0287330b6ed

    • SSDEEP

      6144:czL7ShWDLVzVNam6GxI29dqG3KdYAYqTuPZp:qDHNam62ZdKmZmuPH

    • GandCrab payload

    • Gandcrab

      Gandcrab is a Trojan horse that encrypts files on a computer.

    • Detects Reflective DLL injection artifacts

    • Detects ransomware indicator

    • Gandcrab Payload

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Enterprise v15

Tasks