Overview

overview

10

Static

static

10

2024-04-20...ab.exe

windows7-x64

10

2024-04-20...ab.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    2024-04-20_7277c0a89fa1955d9b01ddbbf856d455_gandcrab

  • Size

    145KB

  • Sample

    240420-m8hqjafa88

  • MD5

    7277c0a89fa1955d9b01ddbbf856d455

  • SHA1

    8365b2b702d4d49307a672350f9b3012e8ad1dd4

  • SHA256

    c5285e3ca6e946c5dec1e3d0fc5359e03ba60fbc6f1d1b068c5d4f3145431974

  • SHA512

    8ffd11b72ebdab8a2a3c9333a46fbd1bad8a56190778633045d0fcfd095cfd6b3537f8c4f29e8b82c6be4e0081e01965d3b2a081628a7b894e66540f6341715d

  • SSDEEP

    3072:HYHVHd2NCMqqDL2/mr3IdE8we0Avu5r++ygLIaagvdCjRv9OtN:HyOqqDL64vdGREz

Score
10/10
gandcrabbackdoorpersistenceransomware

Malware Config

Targets

    • Target

      2024-04-20_7277c0a89fa1955d9b01ddbbf856d455_gandcrab

    • Size

      145KB

    • MD5

      7277c0a89fa1955d9b01ddbbf856d455

    • SHA1

      8365b2b702d4d49307a672350f9b3012e8ad1dd4

    • SHA256

      c5285e3ca6e946c5dec1e3d0fc5359e03ba60fbc6f1d1b068c5d4f3145431974

    • SHA512

      8ffd11b72ebdab8a2a3c9333a46fbd1bad8a56190778633045d0fcfd095cfd6b3537f8c4f29e8b82c6be4e0081e01965d3b2a081628a7b894e66540f6341715d

    • SSDEEP

      3072:HYHVHd2NCMqqDL2/mr3IdE8we0Avu5r++ygLIaagvdCjRv9OtN:HyOqqDL64vdGREz

    Score
    10/10
    gandcrabbackdoorpersistenceransomware

    • GandCrab payload

    • Gandcrab

      Gandcrab is a Trojan horse that encrypts files on a computer.

      ransomwarebackdoorgandcrab

    • Detects ransomware indicator

    • Gandcrab Payload

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks