Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    2025-01-04_f8b854da08106be040fa23cb69d251af_gandcrab

  • Size

    286KB

  • Sample

    250104-f1cqzswnem

  • MD5

    f8b854da08106be040fa23cb69d251af

  • SHA1

    c85b9329a5bd76402077b372f607096a215011ec

  • SHA256

    1785da4591e8813880d9867ab651aeb4d446715248ceffdf11cf1f8af5eb9e6c

  • SHA512

    7b8f4ee058a046caa4292dc09642b326e7b378218ad2e8a17c89bf741df7e5d683b2e1a12978a498d07676804927a1a938b3650c055d519e25990810a9e3c653

  • SSDEEP

    6144:iXjOnr6gqqDL64vd0xrm1sSfa7F5pDYD+x/W836eiO/swGXuY2YJ+p3ssqpsYOH4:iTOnYqn6cwrm1sB7F51YD+lW8qeiO/sf

Malware Config

Extracted

Family

gandcrab

C2

http://gdcbghvjyqy7jclk.onion.top/

Targets

    • Target

      2025-01-04_f8b854da08106be040fa23cb69d251af_gandcrab

    • Size

      286KB

    • MD5

      f8b854da08106be040fa23cb69d251af

    • SHA1

      c85b9329a5bd76402077b372f607096a215011ec

    • SHA256

      1785da4591e8813880d9867ab651aeb4d446715248ceffdf11cf1f8af5eb9e6c

    • SHA512

      7b8f4ee058a046caa4292dc09642b326e7b378218ad2e8a17c89bf741df7e5d683b2e1a12978a498d07676804927a1a938b3650c055d519e25990810a9e3c653

    • SSDEEP

      6144:iXjOnr6gqqDL64vd0xrm1sSfa7F5pDYD+x/W836eiO/swGXuY2YJ+p3ssqpsYOH4:iTOnYqn6cwrm1sB7F51YD+lW8qeiO/sf

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Enterprise v15

Tasks