Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    2024-07-09_036bec48758bd4c668ec4261e9745512_gandcrab

  • Size

    77KB

  • Sample

    240709-t9lbdavgmc

  • MD5

    036bec48758bd4c668ec4261e9745512

  • SHA1

    3ef51183b371773e3be350b94bcb08c6809f83c1

  • SHA256

    d865e71fb51c3cf54cb84d12b3891a0ec1c785706e53746c95ad74cb36196e4b

  • SHA512

    585f25887b0c788478d1a88d572fd9a9c879c2ec371e8dc468a26ab7cd00962198e25f234ea9ca08629a9e368f09f70092596de032d8245b72ab4f9baa4c3175

  • SSDEEP

    1536:VgSeGDjnjhnwjyB0yjMqqUM2mr3IdE8mne0Avu5r++yy7CA7GcIaapavdv9:VMSjVneyBbMqqMmr3IdE8we0Avu5r++X

Malware Config

Extracted

Family

gandcrab

C2

http://gdcbghvjyqy7jclk.onion.top/

Targets

    • Target

      2024-07-09_036bec48758bd4c668ec4261e9745512_gandcrab

    • Size

      77KB

    • MD5

      036bec48758bd4c668ec4261e9745512

    • SHA1

      3ef51183b371773e3be350b94bcb08c6809f83c1

    • SHA256

      d865e71fb51c3cf54cb84d12b3891a0ec1c785706e53746c95ad74cb36196e4b

    • SHA512

      585f25887b0c788478d1a88d572fd9a9c879c2ec371e8dc468a26ab7cd00962198e25f234ea9ca08629a9e368f09f70092596de032d8245b72ab4f9baa4c3175

    • SSDEEP

      1536:VgSeGDjnjhnwjyB0yjMqqUM2mr3IdE8mne0Avu5r++yy7CA7GcIaapavdv9:VMSjVneyBbMqqMmr3IdE8we0Avu5r++X

    • GandCrab payload

    • Gandcrab

      Gandcrab is a Trojan horse that encrypts files on a computer.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Enterprise v15

Tasks