General

  • Target

    2024-05-03_890a301bfdb6f37f1c394f8646d49a64_gandcrab

  • Size

    145KB

  • Sample

    240503-t67p7sbc2t

  • MD5

    890a301bfdb6f37f1c394f8646d49a64

  • SHA1

    4e01a25cf8958361d16b94ffa922cb896f3f2cd2

  • SHA256

    4cd9f9deb0b0907605a37105a39e9e87c60f49271a18122ee1592012b8d02774

  • SHA512

    bd4edc1c719eb8b6d2dc30c870a76fbd16e7790fe955e07dee97edd1ae4b00d4ed12a3f010ddd1f6a408660bc3079875902415153ae61e32edd546a72dfe6102

  • SSDEEP

    3072:0YHVHd2NCMqqDL2/mr3IdE8we0Avu5r++ygLIaagvdCjRv9OtN:0yOqqDL64vdGREz

Malware Config

Targets

    • Target

      2024-05-03_890a301bfdb6f37f1c394f8646d49a64_gandcrab

    • Size

      145KB

    • MD5

      890a301bfdb6f37f1c394f8646d49a64

    • SHA1

      4e01a25cf8958361d16b94ffa922cb896f3f2cd2

    • SHA256

      4cd9f9deb0b0907605a37105a39e9e87c60f49271a18122ee1592012b8d02774

    • SHA512

      bd4edc1c719eb8b6d2dc30c870a76fbd16e7790fe955e07dee97edd1ae4b00d4ed12a3f010ddd1f6a408660bc3079875902415153ae61e32edd546a72dfe6102

    • SSDEEP

      3072:0YHVHd2NCMqqDL2/mr3IdE8we0Avu5r++ygLIaagvdCjRv9OtN:0yOqqDL64vdGREz

    • GandCrab payload

    • Gandcrab

      Gandcrab is a Trojan horse that encrypts files on a computer.

    • Detects ransomware indicator

    • Gandcrab Payload

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Enterprise v15

Tasks