Overview

overview

10

Static

static

3

2024-10-21...ia.exe

windows7-x64

10

2024-10-21...ia.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-10-21_6c7a72d3143146ef04233a6c63ab82af_karagany_mafia

  • Size

    222KB

  • Sample

    241021-yd3m1avanp

  • MD5

    6c7a72d3143146ef04233a6c63ab82af

  • SHA1

    930021705b843317e678fd9d4ba79387a9b0d041

  • SHA256

    baeea6d3e9a6d2a839d45118239677ea957fb1f512b186516fd2ef13d5232a1a

  • SHA512

    a66dfc0937f39975c4114181882c4a063a6f9f9c08dd9467f7c5533ba9f6e88984ab465de11874076ee978350cceb8c4432cf49079021e1fda875479fcb17e4e

  • SSDEEP

    3072:cBbWxYKFDnqvffIj0nStxBN3cwqvcQr3YTfVEPnYbl3/YrDAEioKhAvx:cBkYKZSYYnS1xecmoT2nYbdEKsx

Score
10/10
gandcrabbackdoordiscoverypersistenceransomware

Malware Config

Targets

    • Target

      2024-10-21_6c7a72d3143146ef04233a6c63ab82af_karagany_mafia

    • Size

      222KB

    • MD5

      6c7a72d3143146ef04233a6c63ab82af

    • SHA1

      930021705b843317e678fd9d4ba79387a9b0d041

    • SHA256

      baeea6d3e9a6d2a839d45118239677ea957fb1f512b186516fd2ef13d5232a1a

    • SHA512

      a66dfc0937f39975c4114181882c4a063a6f9f9c08dd9467f7c5533ba9f6e88984ab465de11874076ee978350cceb8c4432cf49079021e1fda875479fcb17e4e

    • SSDEEP

      3072:cBbWxYKFDnqvffIj0nStxBN3cwqvcQr3YTfVEPnYbl3/YrDAEioKhAvx:cBkYKZSYYnS1xecmoT2nYbdEKsx

    Score
    10/10
    gandcrabbackdoordiscoverypersistenceransomware

    • GandCrab payload

    • Gandcrab

      Gandcrab is a Trojan horse that encrypts files on a computer.

      ransomwarebackdoorgandcrab

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks