gandcrab | 94f5d8e1f8eaf0341fcdc34bba042030ac611fdf489c1737cce28cc23d68c4f2 | Triage

Submit
Reports

Overview

overview

Static

static

3

94f5d8e1f8...f2.exe

windows7-x64

94f5d8e1f8...f2.exe

windows10-2004-x64

Sharing

General

Target

94f5d8e1f8eaf0341fcdc34bba042030ac611fdf489c1737cce28cc23d68c4f2
Size

171KB
Sample

241217-bc5dwavqgw
MD5

d7c25072c2ce1434f6b2cffe35a7e8c8
SHA1

6bec15bcb1a156476036f0a30724dc321eed5eea
SHA256

94f5d8e1f8eaf0341fcdc34bba042030ac611fdf489c1737cce28cc23d68c4f2
SHA512

590f107882846042d5a73db6eda36a526a44c7f260064562712652bff27c13298342dae648405db77e51a98f9209710eb53450a818ba093060601383d603e720
SSDEEP

3072:zjQgjwASMrYRL9xNg2WvKpRsDCEQUbVu8JGYg1Yv/O/j2H3HnBBr:H9+AvyRw/bVuaGckj2XH7

Score

10^/10

gandcrab backdoor discovery persistence ransomware

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

94f5d8e1f8eaf0341fcdc34bba042030ac611fdf489c1737cce28cc23d68c4f2.exe

Resource

win7-20240903-en

gandcrab backdoor discovery persistence ransomware

windows7-x64

10 signatures

150 seconds

Behavioral task

behavioral2

Sample

94f5d8e1f8eaf0341fcdc34bba042030ac611fdf489c1737cce28cc23d68c4f2.exe

Resource

win10v2004-20241007-en

gandcrab backdoor discovery ransomware

windows10-2004-x64

6 signatures

150 seconds

Malware Config

Targets

- Target
  
  94f5d8e1f8eaf0341fcdc34bba042030ac611fdf489c1737cce28cc23d68c4f2
- Size
  
  171KB
- MD5
  
  d7c25072c2ce1434f6b2cffe35a7e8c8
- SHA1
  
  6bec15bcb1a156476036f0a30724dc321eed5eea
- SHA256
  
  94f5d8e1f8eaf0341fcdc34bba042030ac611fdf489c1737cce28cc23d68c4f2
- SHA512
  
  590f107882846042d5a73db6eda36a526a44c7f260064562712652bff27c13298342dae648405db77e51a98f9209710eb53450a818ba093060601383d603e720
- SSDEEP
  
  3072:zjQgjwASMrYRL9xNg2WvKpRsDCEQUbVu8JGYg1Yv/O/j2H3HnBBr:H9+AvyRw/bVuaGckj2XH7
Score

10^/10

gandcrab backdoor discovery persistence ransomware
- GandCrab payload
- Gandcrab
  Gandcrab is a Trojan horse that encrypts files on a computer.
  ransomware backdoor gandcrab
- Gandcrab family
  gandcrab
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gandcrabbackdoordiscoverypersistenceransomware

behavioral2

gandcrabbackdoordiscoveryransomware

© 2018-2024

Terms | Privacy