General

  • Target

    2024-04-10_d682c619a7ef74d7f67fcbf6a124f2b3_karagany_mafia

  • Size

    250KB

  • Sample

    240410-vggm6aed65

  • MD5

    d682c619a7ef74d7f67fcbf6a124f2b3

  • SHA1

    1ab16f1acdd325e0930ddabbed39ff6a923353f5

  • SHA256

    a56e17eb4232e574e390c481b003f49504220a11f375686cd05587d90059e15d

  • SHA512

    7c76d59b85a57d632899795607cae88fe52c15ac09dd4d7816098fe6ee491e0ae8414c9aeaf3253d369fc534b8726b2dd02129824d1178a94b594431f431136f

  • SSDEEP

    3072:p/yK5d0Gj0+nY3uEBLvBNfdUR2/qFnB8o2+vU3WuvIBuj00nReaXkuSQ7cdOd3:p/y20Gj0r+EBFrkvlU3RvIUDOIN

Malware Config

Targets

    • Target

      2024-04-10_d682c619a7ef74d7f67fcbf6a124f2b3_karagany_mafia

    • Size

      250KB

    • MD5

      d682c619a7ef74d7f67fcbf6a124f2b3

    • SHA1

      1ab16f1acdd325e0930ddabbed39ff6a923353f5

    • SHA256

      a56e17eb4232e574e390c481b003f49504220a11f375686cd05587d90059e15d

    • SHA512

      7c76d59b85a57d632899795607cae88fe52c15ac09dd4d7816098fe6ee491e0ae8414c9aeaf3253d369fc534b8726b2dd02129824d1178a94b594431f431136f

    • SSDEEP

      3072:p/yK5d0Gj0+nY3uEBLvBNfdUR2/qFnB8o2+vU3WuvIBuj00nReaXkuSQ7cdOd3:p/y20Gj0r+EBFrkvlU3RvIUDOIN

    • GandCrab payload

    • Gandcrab

      Gandcrab is a Trojan horse that encrypts files on a computer.

    • Detects Reflective DLL injection artifacts

    • Detects ransomware indicator

    • Gandcrab Payload

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Enterprise v15

Tasks