Overview

overview

10

Static

static

3

2024-04-16...ia.exe

windows7-x64

10

2024-04-16...ia.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    2024-04-16_04f34490332024e32b378958d23be417_mafia

  • Size

    316KB

  • Sample

    240416-e2plhahd62

  • MD5

    04f34490332024e32b378958d23be417

  • SHA1

    47feabf0ef466b1df37e6f4eaa93803a6225bce8

  • SHA256

    4a4acaf394ab37f6a6c59ace9e9d59e0cf8279b205c2e593580070fe5154949f

  • SHA512

    90ece085a97ec199ffe4d334706b88c7ef57f4081e9ff874b3ac1e1a172f235efe7bb21eb8b086b9941e62c4f85b064c75460003f7e5746752d1ad519a10a1ec

  • SSDEEP

    6144:PvEANMO1UnseVgkV0xwvfxnhLTiusLe1740w:EuM0Unsna5mut40w

Score
10/10
gandcrabbackdoorpersistenceransomware

Malware Config

Targets

    • Target

      2024-04-16_04f34490332024e32b378958d23be417_mafia

    • Size

      316KB

    • MD5

      04f34490332024e32b378958d23be417

    • SHA1

      47feabf0ef466b1df37e6f4eaa93803a6225bce8

    • SHA256

      4a4acaf394ab37f6a6c59ace9e9d59e0cf8279b205c2e593580070fe5154949f

    • SHA512

      90ece085a97ec199ffe4d334706b88c7ef57f4081e9ff874b3ac1e1a172f235efe7bb21eb8b086b9941e62c4f85b064c75460003f7e5746752d1ad519a10a1ec

    • SSDEEP

      6144:PvEANMO1UnseVgkV0xwvfxnhLTiusLe1740w:EuM0Unsna5mut40w

    Score
    10/10
    gandcrabbackdoorpersistenceransomware

    • GandCrab payload

    • Gandcrab

      Gandcrab is a Trojan horse that encrypts files on a computer.

      ransomwarebackdoorgandcrab

    • Detects Reflective DLL injection artifacts

    • Detects ransomware indicator

    • Gandcrab Payload

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks