Overview

overview

10

Static

static

10

2025-01-04...ab.exe

windows7-x64

6

2025-01-04...ab.exe

windows10-2004-x64

6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2025-01-04_5aad2ef95d580626f203c67c4964e109_gandcrab

  • Size

    304KB

  • Sample

    250104-ew2c4stlgn

  • MD5

    5aad2ef95d580626f203c67c4964e109

  • SHA1

    6745617bc5e3d38a185e9d46a025b3138ee1ea97

  • SHA256

    1ee1646f20e19f4507153782a3ecba0502d2a3e16d7497bb4ec069a83e18b06d

  • SHA512

    3ff6a44da7952a8671f71294e0053f50041c9ed4dc2a69976b92f010f58457791bb4476dc5e646c6ba5e171a37deeb9026bc5c7944e6c81c94054d24a8016d98

  • SSDEEP

    6144:UXjOnr6gqqDL64vdTrmwYhnwgRDC9iZN3gxPV8HlM7Id4nLo+aWaJCr5ZhYz/bho:UTOnYqn6cTBYlwrAZZgxPV8FM7Id4Lo6

Score
10/10
gandcrabdiscoverypersistence

Malware Config

Extracted

Family

gandcrab

C2

http://gdcbghvjyqy7jclk.onion.top/

Targets

    • Target

      2025-01-04_5aad2ef95d580626f203c67c4964e109_gandcrab

    • Size

      304KB

    • MD5

      5aad2ef95d580626f203c67c4964e109

    • SHA1

      6745617bc5e3d38a185e9d46a025b3138ee1ea97

    • SHA256

      1ee1646f20e19f4507153782a3ecba0502d2a3e16d7497bb4ec069a83e18b06d

    • SHA512

      3ff6a44da7952a8671f71294e0053f50041c9ed4dc2a69976b92f010f58457791bb4476dc5e646c6ba5e171a37deeb9026bc5c7944e6c81c94054d24a8016d98

    • SSDEEP

      6144:UXjOnr6gqqDL64vdTrmwYhnwgRDC9iZN3gxPV8HlM7Id4nLo+aWaJCr5ZhYz/bho:UTOnYqn6cTBYlwrAZZgxPV8FM7Id4Lo6

    Score
    6/10
    discoverypersistence

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks