Overview

overview

10

Static

static

10

2024-11-18...ab.exe

windows7-x64

10

2024-11-18...ab.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-11-18_06bb3e26f98fd902f3f023c5bedb1850_gandcrab

  • Size

    240KB

  • Sample

    241118-bsczkavfrq

  • MD5

    06bb3e26f98fd902f3f023c5bedb1850

  • SHA1

    bacd24ac09f24a8102e78e56bc1b8c33b103d6a5

  • SHA256

    1be6d76ab1f5d4fa2c72a2df61ac1ba2dd99ae5911b9eb25e599cba8e9ec1500

  • SHA512

    37441a65c36916ef40b8a2e79bf935ee9abd8a08fef43b3dbdd5a404c0d78297edbcfe33eb40624de306a155a1be16b1c729c71f30f1324131cffc3c2cd987d2

  • SSDEEP

    3072:LYHVHd2NwMqqDL2/mr3IdE8we0Avu5r++ygLIaa4jRv9OtNZpHk:LycqqDL6oREzZpE

Score
10/10
gandcrabbackdoordiscoverypersistenceransomwareupx

Malware Config

Targets

    • Target

      2024-11-18_06bb3e26f98fd902f3f023c5bedb1850_gandcrab

    • Size

      240KB

    • MD5

      06bb3e26f98fd902f3f023c5bedb1850

    • SHA1

      bacd24ac09f24a8102e78e56bc1b8c33b103d6a5

    • SHA256

      1be6d76ab1f5d4fa2c72a2df61ac1ba2dd99ae5911b9eb25e599cba8e9ec1500

    • SHA512

      37441a65c36916ef40b8a2e79bf935ee9abd8a08fef43b3dbdd5a404c0d78297edbcfe33eb40624de306a155a1be16b1c729c71f30f1324131cffc3c2cd987d2

    • SSDEEP

      3072:LYHVHd2NwMqqDL2/mr3IdE8we0Avu5r++ygLIaa4jRv9OtNZpHk:LycqqDL6oREzZpE

    Score
    10/10
    gandcrabbackdoordiscoverypersistenceransomwareupx

    • GandCrab payload

    • Gandcrab

      Gandcrab is a Trojan horse that encrypts files on a computer.

      ransomwarebackdoorgandcrab

    • Gandcrab family

      gandcrab

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks