gandcrab | 61b19e50c036f22e03599acb09e8fd056f09a934b1efcc899bf53da2f398f492 | Triage

Submit
Reports

Overview

overview

Static

static

3

JaffaCakes...6b.exe

windows7-x64

JaffaCakes...6b.exe

windows10-2004-x64

Sharing

General

Target

JaffaCakes118_16b222f50c954c95acc21eda1e724f6b
Size

178KB
Sample

241231-m43vxaxldy
MD5

16b222f50c954c95acc21eda1e724f6b
SHA1

d146f7e0b3c7bbc469ead624b44811da0b168103
SHA256

61b19e50c036f22e03599acb09e8fd056f09a934b1efcc899bf53da2f398f492
SHA512

cf0094c0a01641e08f8a49d0bfa9bd5173ce0333055cb35f827a604bbe38834ab0400e669921ed387611c87044227d0de71f8e0939b56a1221f14b4bc0b48881
SSDEEP

3072:g+j5rKOymvKc+axlGUuNTFwFF1Ozx0bKxGyAjBTkEFiAN77sQoTEKO:g+I1my6xEzNTFI82bKsyAj9kEFiANvtN

Score

10^/10

gandcrab backdoor discovery persistence ransomware

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

JaffaCakes118_16b222f50c954c95acc21eda1e724f6b.exe

Resource

win7-20240903-en

gandcrab backdoor discovery persistence ransomware

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral2

Sample

JaffaCakes118_16b222f50c954c95acc21eda1e724f6b.exe

Resource

win10v2004-20241007-en

gandcrab backdoor discovery ransomware

windows10-2004-x64

6 signatures

150 seconds

Malware Config

Targets

- Target
  
  JaffaCakes118_16b222f50c954c95acc21eda1e724f6b
- Size
  
  178KB
- MD5
  
  16b222f50c954c95acc21eda1e724f6b
- SHA1
  
  d146f7e0b3c7bbc469ead624b44811da0b168103
- SHA256
  
  61b19e50c036f22e03599acb09e8fd056f09a934b1efcc899bf53da2f398f492
- SHA512
  
  cf0094c0a01641e08f8a49d0bfa9bd5173ce0333055cb35f827a604bbe38834ab0400e669921ed387611c87044227d0de71f8e0939b56a1221f14b4bc0b48881
- SSDEEP
  
  3072:g+j5rKOymvKc+axlGUuNTFwFF1Ozx0bKxGyAjBTkEFiAN77sQoTEKO:g+I1my6xEzNTFI82bKsyAj9kEFiANvtN
Score

10^/10

gandcrab backdoor discovery persistence ransomware
- GandCrab payload
- Gandcrab
  Gandcrab is a Trojan horse that encrypts files on a computer.
  ransomware backdoor gandcrab
- Gandcrab family
  gandcrab
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gandcrabbackdoordiscoverypersistenceransomware

behavioral2

gandcrabbackdoordiscoveryransomware

© 2018-2025

Terms | Privacy