Overview

overview

10

Static

static

3

AsepriteTo...er.exe

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    AsepriteToolInstaller.exe

  • Size

    14.1MB

  • Sample

    241007-ent9tsyeph

  • MD5

    05fa8f159d573796a10ebc7ff71ead46

  • SHA1

    21596be221232066e07e454685fd87770baa5002

  • SHA256

    8e5deeda104e2d39c40cd5251f598c640e03f49a1fde55a16e2a999208f0d48a

  • SHA512

    4a23ef81563d6ad9b2e93918b431fdbba3d3e7725ed9835d8bfefb1e1028112234f9217524a994688656fe78f208ef13f8b4aec4abe48a72e87313b5928809e4

  • SSDEEP

    393216:E6UiaGcbN3gSEA/qstVBHdfczPq4yAUtw:E6OwkCK/cj3cw

Score
10/10
gandcrabbackdoordiscoverypyinstallerransomware

Malware Config

Targets

    • Target

      AsepriteToolInstaller.exe

    • Size

      14.1MB

    • MD5

      05fa8f159d573796a10ebc7ff71ead46

    • SHA1

      21596be221232066e07e454685fd87770baa5002

    • SHA256

      8e5deeda104e2d39c40cd5251f598c640e03f49a1fde55a16e2a999208f0d48a

    • SHA512

      4a23ef81563d6ad9b2e93918b431fdbba3d3e7725ed9835d8bfefb1e1028112234f9217524a994688656fe78f208ef13f8b4aec4abe48a72e87313b5928809e4

    • SSDEEP

      393216:E6UiaGcbN3gSEA/qstVBHdfczPq4yAUtw:E6OwkCK/cj3cw

    Score
    10/10
    gandcrabbackdoordiscoverypyinstallerransomware

    • Gandcrab

      Gandcrab is a Trojan horse that encrypts files on a computer.

      ransomwarebackdoorgandcrab

    • Executes dropped EXE

    • Loads dropped DLL

    • Blocklisted process makes network request

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks