gandcrab | 9e8188d8b3d6579051c2568d97e92b410c8ea0bb66e46d39cd9a9ea6b6b8a391 | Triage

Sharing

General

Target

2024-09-19_972a1e759e3fec4b26cc2d9af7ae81cd_bkransomware_karagany_metamorfo
Size

213KB
Sample

240919-q6h53a1gmc
MD5

972a1e759e3fec4b26cc2d9af7ae81cd
SHA1

a60a12b9b748288f39a5ae98918de944fac47fca
SHA256

9e8188d8b3d6579051c2568d97e92b410c8ea0bb66e46d39cd9a9ea6b6b8a391
SHA512

9207414fcc471a39a6f15544ce8517865a8686b16dac20461d53c0cefc8322cc5e5337ffc48dad81542a5a6d43552749a0b3d691340e5a178695b48ea736f513
SSDEEP

3072:QgzlmnQjGj/A78nRw3u04PbvZDV/y9afXqTXnCBNcESnrbieOVL5vYvQd2a:QiV78Rw2hpy9afajnCBwrbTO9Ya

Score

10^/10

gandcrab backdoor discovery persistence ransomware

Malware Config

Targets

- Target
  
  2024-09-19_972a1e759e3fec4b26cc2d9af7ae81cd_bkransomware_karagany_metamorfo
- Size
  
  213KB
- MD5
  
  972a1e759e3fec4b26cc2d9af7ae81cd
- SHA1
  
  a60a12b9b748288f39a5ae98918de944fac47fca
- SHA256
  
  9e8188d8b3d6579051c2568d97e92b410c8ea0bb66e46d39cd9a9ea6b6b8a391
- SHA512
  
  9207414fcc471a39a6f15544ce8517865a8686b16dac20461d53c0cefc8322cc5e5337ffc48dad81542a5a6d43552749a0b3d691340e5a178695b48ea736f513
- SSDEEP
  
  3072:QgzlmnQjGj/A78nRw3u04PbvZDV/y9afXqTXnCBNcESnrbieOVL5vYvQd2a:QiV78Rw2hpy9afajnCBwrbTO9Ya
Score

10^/10

gandcrab backdoor discovery persistence ransomware
- GandCrab payload
- Gandcrab
  Gandcrab is a Trojan horse that encrypts files on a computer.
  ransomware backdoor gandcrab
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gandcrabbackdoordiscoverypersistenceransomware

behavioral2

gandcrabbackdoordiscoverypersistenceransomware