gandcrab | 0351ef062484c1622ab574835ae1bd4f5e2c0142d8a6f207c8760df8d5e07800 | Triage

Submit
Reports

Overview

overview

Static

static

3

0351ef0624...0N.exe

windows7-x64

0351ef0624...0N.exe

windows10-2004-x64

Resubmissions

19-12-2024 21:54

241219-1sgp7a1kax 4

19-12-2024 20:39

241219-zflb6szkel 10

Sharing

General

Target

0351ef062484c1622ab574835ae1bd4f5e2c0142d8a6f207c8760df8d5e07800N.exe
Size

244KB
Sample

241219-zflb6szkel
MD5

57772ebf37c3c7376a932a39c1c7f770
SHA1

eac21915ff9db1604b77efcfd788bce5a051cb3a
SHA256

0351ef062484c1622ab574835ae1bd4f5e2c0142d8a6f207c8760df8d5e07800
SHA512

2b1696e813912681063b0ae1463011463ea05380e18586d0d5fd6185c9a5c45077af192c90ed9db2f23ee8b879ce773befa781553a00080d5202c5d831b8f982
SSDEEP

3072:3q8QC2mCC97sjM2TGm54rYREkcuX8FdXIsLCiQU2jgXQk0rCQRGEsriUIwrmuVUt:zKwm5RDOCiQFju0ubEslxrmt

Score

10^/10

gandcrab backdoor discovery persistence ransomware

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

0351ef062484c1622ab574835ae1bd4f5e2c0142d8a6f207c8760df8d5e07800N.exe

Resource

win7-20240903-en

gandcrab backdoor discovery persistence ransomware

windows7-x64

11 signatures

120 seconds

Behavioral task

behavioral2

Sample

0351ef062484c1622ab574835ae1bd4f5e2c0142d8a6f207c8760df8d5e07800N.exe

Resource

win10v2004-20241007-en

gandcrab backdoor discovery ransomware

windows10-2004-x64

6 signatures

120 seconds

Malware Config

Targets

- Target
  
  0351ef062484c1622ab574835ae1bd4f5e2c0142d8a6f207c8760df8d5e07800N.exe
- Size
  
  244KB
- MD5
  
  57772ebf37c3c7376a932a39c1c7f770
- SHA1
  
  eac21915ff9db1604b77efcfd788bce5a051cb3a
- SHA256
  
  0351ef062484c1622ab574835ae1bd4f5e2c0142d8a6f207c8760df8d5e07800
- SHA512
  
  2b1696e813912681063b0ae1463011463ea05380e18586d0d5fd6185c9a5c45077af192c90ed9db2f23ee8b879ce773befa781553a00080d5202c5d831b8f982
- SSDEEP
  
  3072:3q8QC2mCC97sjM2TGm54rYREkcuX8FdXIsLCiQU2jgXQk0rCQRGEsriUIwrmuVUt:zKwm5RDOCiQFju0ubEslxrmt
Score

10^/10

gandcrab backdoor discovery persistence ransomware
- GandCrab payload
- Gandcrab
  Gandcrab is a Trojan horse that encrypts files on a computer.
  ransomware backdoor gandcrab
- Gandcrab family
  gandcrab
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gandcrabbackdoordiscoverypersistenceransomware

behavioral2

gandcrabbackdoordiscoveryransomware

© 2018-2024

Terms | Privacy