Overview

overview

10

Static

static

10

2024-11-26...ab.exe

windows7-x64

10

2024-11-26...ab.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-11-26_e6fba53d56b11ab00c8bcdd86ee2ab69_gandcrab

  • Size

    240KB

  • Sample

    241126-cwdwpsyrcs

  • MD5

    e6fba53d56b11ab00c8bcdd86ee2ab69

  • SHA1

    a3d56e59d26bae480aae3464393da8129e844f22

  • SHA256

    60c7eaa959a67e276e2b5451efe54b8af62fd891b60718e019536cdf1e3651b2

  • SHA512

    7b1d6447104a96fa83d21fdb22b398cec06db3798c9baeb8a9f555b2fccdf2df1e68f1237cb6e6e9528524f78547d1e69cbae4db6b9b5f8ef4dd0d2bc5de260a

  • SSDEEP

    3072:+YHVHd2NwMqqDL2/mr3IdE8we0Avu5r++ygLIaa4jRv9OtNZpHk:+ycqqDL6oREzZpE

Score
10/10
gandcrabbackdoordiscoverypersistenceransomwareupx

Malware Config

Targets

    • Target

      2024-11-26_e6fba53d56b11ab00c8bcdd86ee2ab69_gandcrab

    • Size

      240KB

    • MD5

      e6fba53d56b11ab00c8bcdd86ee2ab69

    • SHA1

      a3d56e59d26bae480aae3464393da8129e844f22

    • SHA256

      60c7eaa959a67e276e2b5451efe54b8af62fd891b60718e019536cdf1e3651b2

    • SHA512

      7b1d6447104a96fa83d21fdb22b398cec06db3798c9baeb8a9f555b2fccdf2df1e68f1237cb6e6e9528524f78547d1e69cbae4db6b9b5f8ef4dd0d2bc5de260a

    • SSDEEP

      3072:+YHVHd2NwMqqDL2/mr3IdE8we0Avu5r++ygLIaa4jRv9OtNZpHk:+ycqqDL6oREzZpE

    Score
    10/10
    gandcrabbackdoordiscoverypersistenceransomwareupx

    • GandCrab payload

    • Gandcrab

      Gandcrab is a Trojan horse that encrypts files on a computer.

      ransomwarebackdoorgandcrab

    • Gandcrab family

      gandcrab

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks