Overview

overview

10

Static

static

3

2025-01-11...ia.exe

windows7-x64

10

2025-01-11...ia.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2025-01-11_6da5b34486b0718f4c25a6fa22b2c29c_karagany_mafia

  • Size

    304KB

  • Sample

    250111-g8rqjsymgy

  • MD5

    6da5b34486b0718f4c25a6fa22b2c29c

  • SHA1

    31cbe012cb1dabd8394964c987e20afd9e5d0629

  • SHA256

    8a020f2fad1de378ef53fd27d97820e80e3d3313dffb99ffb3fcef8301ef87d6

  • SHA512

    53f4596c95ceb595a44f1a6d0a3587392ffa00eadd112e19391fa755afe6849892a7f2a9c567d452c6b4f874c9c789387f7c08f75fdeab50925801f487728a92

  • SSDEEP

    6144:SzL7ShWDhbzVNam6GxI29dqG3KdYAYqTuPZd:YDrNam62ZdKmZmuPz

Score
10/10
gandcrabbackdoordiscoverypersistenceransomware

Malware Config

Targets

    • Target

      2025-01-11_6da5b34486b0718f4c25a6fa22b2c29c_karagany_mafia

    • Size

      304KB

    • MD5

      6da5b34486b0718f4c25a6fa22b2c29c

    • SHA1

      31cbe012cb1dabd8394964c987e20afd9e5d0629

    • SHA256

      8a020f2fad1de378ef53fd27d97820e80e3d3313dffb99ffb3fcef8301ef87d6

    • SHA512

      53f4596c95ceb595a44f1a6d0a3587392ffa00eadd112e19391fa755afe6849892a7f2a9c567d452c6b4f874c9c789387f7c08f75fdeab50925801f487728a92

    • SSDEEP

      6144:SzL7ShWDhbzVNam6GxI29dqG3KdYAYqTuPZd:YDrNam62ZdKmZmuPz

    Score
    10/10
    gandcrabbackdoordiscoverypersistenceransomware

    • GandCrab payload

    • Gandcrab

      Gandcrab is a Trojan horse that encrypts files on a computer.

      ransomwarebackdoorgandcrab

    • Gandcrab family

      gandcrab

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks