gandcrab | 31bf7d1beb07c960f3a6a01c312ec805231850bb23298e2a26fc84989791cd1b | Triage

Sharing

General

Target

31bf7d1beb07c960f3a6a01c312ec805231850bb23298e2a26fc84989791cd1bN
Size

70KB
Sample

241028-l2whdatphz
MD5

272a2b1a3742c25f94f1b4ad44b9af90
SHA1

4d92dbdd3a4e2beb0f83ad5ea1874082ab8a2378
SHA256

31bf7d1beb07c960f3a6a01c312ec805231850bb23298e2a26fc84989791cd1b
SHA512

a14209d51d18f84458956815cc915b180c5a49b048af06b15798c4b15e84aa935f3566418f50a0337aa20e843fcd072ade2dd134e2091c8e695ce8fadac1555e
SSDEEP

1536:JzzzzzzzzV9rXounV98hbHnAXMqqUM2Lkvd6:vBounVyFHCMqqMLkvd

Score

10^/10

gandcrab backdoor discovery persistence ransomware

Malware Config

Targets

- Target
  
  31bf7d1beb07c960f3a6a01c312ec805231850bb23298e2a26fc84989791cd1bN
- Size
  
  70KB
- MD5
  
  272a2b1a3742c25f94f1b4ad44b9af90
- SHA1
  
  4d92dbdd3a4e2beb0f83ad5ea1874082ab8a2378
- SHA256
  
  31bf7d1beb07c960f3a6a01c312ec805231850bb23298e2a26fc84989791cd1b
- SHA512
  
  a14209d51d18f84458956815cc915b180c5a49b048af06b15798c4b15e84aa935f3566418f50a0337aa20e843fcd072ade2dd134e2091c8e695ce8fadac1555e
- SSDEEP
  
  1536:JzzzzzzzzV9rXounV98hbHnAXMqqUM2Lkvd6:vBounVyFHCMqqMLkvd
Score

10^/10

gandcrab backdoor discovery persistence ransomware
- GandCrab payload
- Gandcrab
  Gandcrab is a Trojan horse that encrypts files on a computer.
  ransomware backdoor gandcrab
- Gandcrab family
  gandcrab
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gandcrabbackdoordiscoverypersistenceransomware

behavioral2

gandcrabbackdoordiscoverypersistenceransomware