Overview

overview

10

Static

static

3

2024041427...ia.exe

windows7-x64

10

2024041427...ia.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    2024041427ca69e29fe86e2c41b43c3f3d09f1bfkaraganymafia.exe

  • Size

    250KB

  • Sample

    240415-s5p84aab26

  • MD5

    27ca69e29fe86e2c41b43c3f3d09f1bf

  • SHA1

    7340b0b71aa4ab5399ba7c93f1cfc082b3c12e1a

  • SHA256

    6ea36409fe84da454540afc6e725354c0082d71f2573559d19e0202693aced25

  • SHA512

    93dbe6a2027e41cfb5fe8cf46a5a78174f9c0ffbff93b310cccc8e1653e9afa3298201925476748c01a68359f692ee7be08feafe8b3417495fce5e91c7154636

  • SSDEEP

    3072:i/yK5d0Gj0+nY3uEBLvBNfdUR2/qFnB8o2+vU3WuvIBuj00nReaXkuSQ7cdOd3:i/y20Gj0r+EBFrkvlU3RvIUDOIN

Score
10/10
gandcrabbackdoorpersistenceransomware

Malware Config

Targets

    • Target

      2024041427ca69e29fe86e2c41b43c3f3d09f1bfkaraganymafia.exe

    • Size

      250KB

    • MD5

      27ca69e29fe86e2c41b43c3f3d09f1bf

    • SHA1

      7340b0b71aa4ab5399ba7c93f1cfc082b3c12e1a

    • SHA256

      6ea36409fe84da454540afc6e725354c0082d71f2573559d19e0202693aced25

    • SHA512

      93dbe6a2027e41cfb5fe8cf46a5a78174f9c0ffbff93b310cccc8e1653e9afa3298201925476748c01a68359f692ee7be08feafe8b3417495fce5e91c7154636

    • SSDEEP

      3072:i/yK5d0Gj0+nY3uEBLvBNfdUR2/qFnB8o2+vU3WuvIBuj00nReaXkuSQ7cdOd3:i/y20Gj0r+EBFrkvlU3RvIUDOIN

    Score
    10/10
    gandcrabbackdoorpersistenceransomware

    • GandCrab payload

    • Gandcrab

      Gandcrab is a Trojan horse that encrypts files on a computer.

      ransomwarebackdoorgandcrab

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks