General

  • Target

    2024-05-07_52370e1a72bab81b6067b613019fb313_karagany_mafia

  • Size

    308KB

  • Sample

    240507-bwd12acc7z

  • MD5

    52370e1a72bab81b6067b613019fb313

  • SHA1

    afe6b58e72a0adc26fa52c9318b9d7155aa99941

  • SHA256

    9780c33289f3df40543ae7bb4680591a2e9ac3015c498d5246e7fcbe03dae564

  • SHA512

    911e1ae775a033d4fe028e496985b381d9c1ba0a5d37aa7fd03d646d418660b8783ba945323a8da835b71d6be2d9e31eb07c4d22e92d2a447323fc96248aa241

  • SSDEEP

    6144:ozL7ShWDLVzVNam6GxI29dqG3KdYAYqTuPZp:ODHNam62ZdKmZmuPH

Malware Config

Targets

    • Target

      2024-05-07_52370e1a72bab81b6067b613019fb313_karagany_mafia

    • Size

      308KB

    • MD5

      52370e1a72bab81b6067b613019fb313

    • SHA1

      afe6b58e72a0adc26fa52c9318b9d7155aa99941

    • SHA256

      9780c33289f3df40543ae7bb4680591a2e9ac3015c498d5246e7fcbe03dae564

    • SHA512

      911e1ae775a033d4fe028e496985b381d9c1ba0a5d37aa7fd03d646d418660b8783ba945323a8da835b71d6be2d9e31eb07c4d22e92d2a447323fc96248aa241

    • SSDEEP

      6144:ozL7ShWDLVzVNam6GxI29dqG3KdYAYqTuPZp:ODHNam62ZdKmZmuPH

    • GandCrab payload

    • Gandcrab

      Gandcrab is a Trojan horse that encrypts files on a computer.

    • Detects Reflective DLL injection artifacts

    • Detects ransomware indicator

    • Gandcrab Payload

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Enterprise v15

Tasks