Overview

overview

10

Static

static

10

2024-10-30...ab.exe

windows7-x64

10

2024-10-30...ab.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-10-30_45c680d5f07b5d184a97c042a0461605_gandcrab

  • Size

    97KB

  • Sample

    241030-eeccnavkgy

  • MD5

    45c680d5f07b5d184a97c042a0461605

  • SHA1

    3b6638615c3b67abe80b3e5ddfea06ba20ba0915

  • SHA256

    17fc51b53242102eed7d156aa9978ce6678d9fd45e7df3f317b0833613317790

  • SHA512

    bb184ee6c27899d423fc866c679fd3f0f6f7d30bfecf33b5539c707962555514d33d59ec1e4467bccddcadc5dca05fe96b1f512dd8d5d4816b63e66ad8b25ae1

  • SSDEEP

    1536:qZZZZZZZZZZZZpXzzzzzzzzzzzzV9rXounV98hbHnAlMqqU+2bbbAV2/S2LNmHkf:cBounVyFHkMqqDL2/LgHkctc

Score
10/10
gandcrabbackdoordiscoverypersistenceransomwareupx

Malware Config

Targets

    • Target

      2024-10-30_45c680d5f07b5d184a97c042a0461605_gandcrab

    • Size

      97KB

    • MD5

      45c680d5f07b5d184a97c042a0461605

    • SHA1

      3b6638615c3b67abe80b3e5ddfea06ba20ba0915

    • SHA256

      17fc51b53242102eed7d156aa9978ce6678d9fd45e7df3f317b0833613317790

    • SHA512

      bb184ee6c27899d423fc866c679fd3f0f6f7d30bfecf33b5539c707962555514d33d59ec1e4467bccddcadc5dca05fe96b1f512dd8d5d4816b63e66ad8b25ae1

    • SSDEEP

      1536:qZZZZZZZZZZZZpXzzzzzzzzzzzzV9rXounV98hbHnAlMqqU+2bbbAV2/S2LNmHkf:cBounVyFHkMqqDL2/LgHkctc

    Score
    10/10
    gandcrabbackdoordiscoverypersistenceransomwareupx

    • GandCrab payload

    • Gandcrab

      Gandcrab is a Trojan horse that encrypts files on a computer.

      ransomwarebackdoorgandcrab

    • Gandcrab family

      gandcrab

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks