Extracted

Extracted

Extracted

Extracted

• • Target

    GrandCrabV5.0.1.bin

  • Size

    2.7MB

  • MD5

    49c158ee65b32cb7f4ca6a769c90bfc0

  • SHA1

    f047d2888c29ee711a9ca627d09f0ddce343c54a

  • SHA256

    b4902aa2802656f873111b272c03ad93ca2dd53c0c612b9d310c982f4afa497b

  • SHA512

    be908bdcd1ae14bd9270a7a4733992a4da440a1326860453f525da2472335b6095094905a89eb833dd2254060cdbf33ce42700c41d8e9075f182f2e8d6fd1001

  • SSDEEP

    49152:N3HyN3QjIm2ANy2NiNQFgFb89Va15682uwgL0KviZiHAtLFTmo9h2A:lHrjIhmiN2V9EvzoKviZFJh2

  Score

  9^/10

  discoverypersistenceransomwarespywarestealer

  • Renames multiple (3347) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Manipulates Digital Signatures

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2behavioral3behavioral4

• • Target

    Ransomware.bin

  • Size

    878KB

  • MD5

    7f29dfc164eff93e11d230a621901145

  • SHA1

    1d9f10518b95315cdc648ba415335ab510804f3e

  • SHA256

    e75e6de7b10900b328ff8f80504a191874ee8c45ca6df94c7ceb59e62cbb15ca

  • SHA512

    0deeca68a6b0449daf33f86c9d0be54bf6c681583618f717cd9cb949a6d9b0a6bb339184df2fc9f21c6f36a8ac9f0e0a80f7b9416b985b1be6ef6149e1978678

  • SSDEEP

    12288:DCdOy3vVrKxR5CXbNjAOxK/j2n+4YG/6c1mFFja3mXgcjfRlgsUBga4TibtQ:DCdxte/80jYLT3U1jfsWaAibtQ

  Score

  6^/10

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral5behavioral6behavioral7behavioral8

• • Target

    fcr.bin

  • Size

    10KB

  • MD5

    f1927e7f90416bf39fc7991bbc57e1b3

  • SHA1

    2367249568ca4a34f8824a9313b03d16d1d7c0bc

  • SHA256

    539b0b5d54757e8a2b754ecdc2939eb7cf9db0ed1728e0eca407500222668505

  • SHA512

    a0ac1811c8944165ba1939e40fe965bba3f7473819cb6f5d1cd4b4e7c203685baec055a6c73359dd1b3ddc79cb05b42d8c7541c29ea466120233423c5a5fcc60

  • SSDEEP

    192:yrj2/2OzcYKNEmkmTjtiIKZIF/2oQlLkMBBm4C:j/2OzcJNEmkmTjkI/92oQjBU7

  Score

  10^/10

  defense_evasionevasionexecutionimpactpersistenceransomwarespywarestealertrojan

  • UAC bypass

    evasiontrojan

  • Clears Windows event logs

    evasionransomware

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Renames multiple (10125) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Power Settings

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence

  • Drops file in System32 directory

  behavioral10behavioral11behavioral12behavioral9