gandcrab | ca2920b5cf3aed05d1f44cde1cf55a941c3eb65ee3c919c44273e60cad44beca | Triage

Submit
Reports

Overview

overview

Static

static

2024-10-19...ab.exe

windows7-x64

2024-10-19...ab.exe

windows10-2004-x64

Resubmissions

19-10-2024 06:13

241019-gyr9bstdkq 10

19-10-2024 03:46

241019-ebptksxdqn 10

Sharing

General

Target

2024-10-19_6b2ac60215296f9435fe3685d8f58b6e_gandcrab
Size

97KB
Sample

241019-ebptksxdqn
MD5

6b2ac60215296f9435fe3685d8f58b6e
SHA1

63e0f6cbc422d92cfe089ceacc78c23a17132c6d
SHA256

ca2920b5cf3aed05d1f44cde1cf55a941c3eb65ee3c919c44273e60cad44beca
SHA512

d500b18636a241ffcbef00699df4b8f0f9b877dd3d2cbc12eddd2d41e2a473a1156b3ab4a1fda52a145cf5e9d9fdc4b0689034123e01ca5be0362d5c9ad53dfc
SSDEEP

1536:YZZZZZZZZZZZZpXzzzzzzzzzzzzV9rXounV98hbHnAlMqqU+2bbbAV2/S2LNmHkf:WBounVyFHkMqqDL2/LgHkctc

Score

10^/10

gandcrab backdoor discovery persistence ransomware upx

Static task

static1

4 signatures

Behavioral task

behavioral1

Sample

2024-10-19_6b2ac60215296f9435fe3685d8f58b6e_gandcrab.exe

Resource

win7-20241010-en

gandcrab backdoor discovery persistence ransomware upx

windows7-x64

9 signatures

150 seconds

Behavioral task

behavioral2

Sample

2024-10-19_6b2ac60215296f9435fe3685d8f58b6e_gandcrab.exe

Resource

win10v2004-20241007-en

gandcrab backdoor discovery persistence ransomware upx

windows10-2004-x64

9 signatures

150 seconds

Malware Config

Targets

- Target
  
  2024-10-19_6b2ac60215296f9435fe3685d8f58b6e_gandcrab
- Size
  
  97KB
- MD5
  
  6b2ac60215296f9435fe3685d8f58b6e
- SHA1
  
  63e0f6cbc422d92cfe089ceacc78c23a17132c6d
- SHA256
  
  ca2920b5cf3aed05d1f44cde1cf55a941c3eb65ee3c919c44273e60cad44beca
- SHA512
  
  d500b18636a241ffcbef00699df4b8f0f9b877dd3d2cbc12eddd2d41e2a473a1156b3ab4a1fda52a145cf5e9d9fdc4b0689034123e01ca5be0362d5c9ad53dfc
- SSDEEP
  
  1536:YZZZZZZZZZZZZpXzzzzzzzzzzzzV9rXounV98hbHnAlMqqU+2bbbAV2/S2LNmHkf:WBounVyFHkMqqDL2/LgHkctc
Score

10^/10

gandcrab backdoor discovery persistence ransomware upx
- GandCrab payload
- Gandcrab
  Gandcrab is a Trojan horse that encrypts files on a computer.
  ransomware backdoor gandcrab
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gandcrabbackdoordiscoverypersistenceransomwareupx

behavioral2

gandcrabbackdoordiscoverypersistenceransomwareupx

© 2018-2025

Terms | Privacy