Extracted

Extracted

• • Target
    3840a023db0a4235495fc3b3e48046c4_JaffaCakes118
  • Size 225KB
  • SHA256 baa3d81ee5a064105cd92ae3474a695324d5cd9e99d1e5d816aacfeffba62cd3
  • MD5 3840a023db0a4235495fc3b3e48046c4
  • SHA1 1011454d00ba23e9425dd311b18f387f7966382e
  • SHA512 36c0dfee25b3ba271b460e55f77ed37491839743add831b2f85e48a599a526bb20d7db79a0c077b535e1eead24559ccb6d5e42a8cba40894cfc2c8f66ca50bd5
  • SSDEEP 3072:CfLnfk1mn7UVGhRXR9cEF3KGx/CgO9PcsibcbQLOEpTR5w1BNH50Idt:CfL8c4VQcEwGxagiPSbIyPKQIb
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  gandcrabbackdoorcredential_accessdefense_evasiondiscoveryexecutionimpactransomwarespywarestealer

  • Gandcrab

    Gandcrab is a Trojan horse that encrypts files on a computer.

    ransomwarebackdoorgandcrab

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Renames multiple (305) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Drops startup file

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2