Overview

overview

10

Static

static

10

2024-10-20...ab.exe

windows7-x64

10

2024-10-20...ab.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-10-20_e8d9fd64551e375fb7ac0ecc21f5476e_gandcrab

  • Size

    97KB

  • Sample

    241020-etsm7a1akk

  • MD5

    e8d9fd64551e375fb7ac0ecc21f5476e

  • SHA1

    f348bcb0482e87904f2fa12c2116ab95a48f8103

  • SHA256

    383f2247cae73a7d0ef768e16ea74fd2f8dd4a8d2387062cbec38e54d6d5ced1

  • SHA512

    d435041eaae976a528a7d7e683ac357cc43529d13cd98c041a0c5f5890a94327cf1dc39573f22444ac9fb229800a9a770b1f83c0d1f15b12e185b669a3cb7492

  • SSDEEP

    1536:sZZZZZZZZZZZZpXzzzzzzzzzzzzV9rXounV98hbHnAlMqqU+2bbbAV2/S2LNmHkf:SBounVyFHkMqqDL2/LgHkctc

Score
10/10
gandcrabbackdoordiscoverypersistenceransomwareupx

Malware Config

Targets

    • Target

      2024-10-20_e8d9fd64551e375fb7ac0ecc21f5476e_gandcrab

    • Size

      97KB

    • MD5

      e8d9fd64551e375fb7ac0ecc21f5476e

    • SHA1

      f348bcb0482e87904f2fa12c2116ab95a48f8103

    • SHA256

      383f2247cae73a7d0ef768e16ea74fd2f8dd4a8d2387062cbec38e54d6d5ced1

    • SHA512

      d435041eaae976a528a7d7e683ac357cc43529d13cd98c041a0c5f5890a94327cf1dc39573f22444ac9fb229800a9a770b1f83c0d1f15b12e185b669a3cb7492

    • SSDEEP

      1536:sZZZZZZZZZZZZpXzzzzzzzzzzzzV9rXounV98hbHnAlMqqU+2bbbAV2/S2LNmHkf:SBounVyFHkMqqDL2/LgHkctc

    Score
    10/10
    gandcrabbackdoordiscoverypersistenceransomwareupx

    • GandCrab payload

    • Gandcrab

      Gandcrab is a Trojan horse that encrypts files on a computer.

      ransomwarebackdoorgandcrab

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks