General

  • Target

    2024-05-04_7a6c214a9cd9053b7110cad7f6b55b59_karagany_mafia

  • Size

    308KB

  • Sample

    240504-kt2hzshc2t

  • MD5

    7a6c214a9cd9053b7110cad7f6b55b59

  • SHA1

    a70718d8dff31f32f0cb36e82a65236519ab40be

  • SHA256

    3398c0e34f5390559d1fa95489cc67b32bb436365499eded82a501226674cc78

  • SHA512

    024b539dae4bf164948718bb7b78a6c09cce4cc2b7381cc86f5a19cf6d9c85615cd1c5deb2f390d40741aeba7b0021614db4528c8abfb73357886fba0a00b262

  • SSDEEP

    6144:1zL7ShWDLVzVNam6GxI29dqG3KdYAYqTuPZp:rDHNam62ZdKmZmuPH

Malware Config

Targets

    • Target

      2024-05-04_7a6c214a9cd9053b7110cad7f6b55b59_karagany_mafia

    • Size

      308KB

    • MD5

      7a6c214a9cd9053b7110cad7f6b55b59

    • SHA1

      a70718d8dff31f32f0cb36e82a65236519ab40be

    • SHA256

      3398c0e34f5390559d1fa95489cc67b32bb436365499eded82a501226674cc78

    • SHA512

      024b539dae4bf164948718bb7b78a6c09cce4cc2b7381cc86f5a19cf6d9c85615cd1c5deb2f390d40741aeba7b0021614db4528c8abfb73357886fba0a00b262

    • SSDEEP

      6144:1zL7ShWDLVzVNam6GxI29dqG3KdYAYqTuPZp:rDHNam62ZdKmZmuPH

    • GandCrab payload

    • Gandcrab

      Gandcrab is a Trojan horse that encrypts files on a computer.

    • Detects Reflective DLL injection artifacts

    • Detects ransomware indicator

    • Gandcrab Payload

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Enterprise v15

Tasks