General

  • Target

    2024-05-04_94dc25ba90bce62092d24767e2c7191a_gandcrab

  • Size

    145KB

  • Sample

    240504-kwz3yaca67

  • MD5

    94dc25ba90bce62092d24767e2c7191a

  • SHA1

    96b8847b632fcd6cfbafeb4e57dfde389e69e21c

  • SHA256

    77de3902fa304924ab22b8127dbdb761a3c57b220a119523bf2942e77c489da1

  • SHA512

    cfe3244be228d4f9ede07c41965682d5ecaff5c19289a355c9838e36bdecfc0b31697bbc4031af410696b9e7b794b6a13b089ec5c485308db2897397a6b75a8a

  • SSDEEP

    3072:AYHVHd2NCMqqDL2/mr3IdE8we0Avu5r++ygLIaagvdCjRv9OtN:AyOqqDL64vdGREz

Malware Config

Targets

    • Target

      2024-05-04_94dc25ba90bce62092d24767e2c7191a_gandcrab

    • Size

      145KB

    • MD5

      94dc25ba90bce62092d24767e2c7191a

    • SHA1

      96b8847b632fcd6cfbafeb4e57dfde389e69e21c

    • SHA256

      77de3902fa304924ab22b8127dbdb761a3c57b220a119523bf2942e77c489da1

    • SHA512

      cfe3244be228d4f9ede07c41965682d5ecaff5c19289a355c9838e36bdecfc0b31697bbc4031af410696b9e7b794b6a13b089ec5c485308db2897397a6b75a8a

    • SSDEEP

      3072:AYHVHd2NCMqqDL2/mr3IdE8we0Avu5r++ygLIaagvdCjRv9OtN:AyOqqDL64vdGREz

    • GandCrab payload

    • Gandcrab

      Gandcrab is a Trojan horse that encrypts files on a computer.

    • Detects ransomware indicator

    • Gandcrab Payload

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Enterprise v15

Tasks