Analysis
-
max time kernel
94s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
02-01-2025 07:21
General
-
Target
2025-01-02_8156536cef4671db835c9ecc5bd3c232_gandcrab.exe
-
Size
78KB
-
MD5
8156536cef4671db835c9ecc5bd3c232
-
SHA1
1f40c66bf428fcb85f47b52f0851d4cdab63c6bb
-
SHA256
88eb3e058dc538f1df6dd361b7c07a8f683ec4fc18eca0db6153dff5b297e12e
-
SHA512
6c47183f847b4bceec2de1b2ec286744b740ebd0f7ec4751eb5bff2c28ca5778fa77af716bcab606f2183463054aeb0ee845de26c92e84ea0ccfbeb094110587
-
SSDEEP
1536:z55u555555555pmgSeGDjtQhnwmmB0ysMqqU+2bbbAV2/S2mr3IdE8mne0Avu5r9:vMSjOnrmBUMqqDL2/mr3IdE8we0Avu5l
Score
10/10
Malware Config
Extracted
Family
gandcrab
C2
http://gdcbghvjyqy7jclk.onion.top/
Signatures
-
GandCrab payload 2 IoCs
-
Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
-
Gandcrab family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-02_8156536cef4671db835c9ecc5bd3c232_gandcrab.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-02_8156536cef4671db835c9ecc5bd3c232_gandcrab.exe"1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
96KB
-
Filesize
96KB