Overview

overview

10

Static

static

10

2024-10-15...ab.exe

windows7-x64

10

2024-10-15...ab.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-10-15_e0aa5dad1156a7bf96c5d516e0e65e2e_gandcrab

  • Size

    167KB

  • Sample

    241015-czm9jszdkh

  • MD5

    e0aa5dad1156a7bf96c5d516e0e65e2e

  • SHA1

    e28121899aecfad7406811a51a0c5bc8b359e29f

  • SHA256

    ae2c6195bd01c093fd74dabd9df9ace3fc59a418fb3b4e386b1287fd204bbf47

  • SHA512

    569694bb6fd48d96206ba9cd6e7442909780ef9a48fc2e00914fededc126bc36e051e4570b7ad67dff3f4381739826f9fd0a933fe7fcd4ada5d684e8192c60c1

  • SSDEEP

    3072:DYHVHd2NFMqqDL2/mr3IdE8we0Avu5r++ygLIaa4jRv9OtNZped:DyZqqDL6oREzZpK

Score
10/10
gandcrabbackdoordiscoverypersistenceransomwareupx

Malware Config

Targets

    • Target

      2024-10-15_e0aa5dad1156a7bf96c5d516e0e65e2e_gandcrab

    • Size

      167KB

    • MD5

      e0aa5dad1156a7bf96c5d516e0e65e2e

    • SHA1

      e28121899aecfad7406811a51a0c5bc8b359e29f

    • SHA256

      ae2c6195bd01c093fd74dabd9df9ace3fc59a418fb3b4e386b1287fd204bbf47

    • SHA512

      569694bb6fd48d96206ba9cd6e7442909780ef9a48fc2e00914fededc126bc36e051e4570b7ad67dff3f4381739826f9fd0a933fe7fcd4ada5d684e8192c60c1

    • SSDEEP

      3072:DYHVHd2NFMqqDL2/mr3IdE8we0Avu5r++ygLIaa4jRv9OtNZped:DyZqqDL6oREzZpK

    Score
    10/10
    gandcrabbackdoordiscoverypersistenceransomwareupx

    • GandCrab payload

    • Gandcrab

      Gandcrab is a Trojan horse that encrypts files on a computer.

      ransomwarebackdoorgandcrab

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks