Overview

overview

10

Static

static

10

2025-01-27...ab.exe

windows7-x64

10

2025-01-27...ab.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2025-01-27_2b8204770e16986ee516ece9f42e1905_gandcrab

  • Size

    97KB

  • Sample

    250127-tv3bcaxpcp

  • MD5

    2b8204770e16986ee516ece9f42e1905

  • SHA1

    58fb35c99cfc4bdc7effd53c10ad2919171347c3

  • SHA256

    d12d340af223125ba4327dc596c1006c4d77c5008a35fcd10ef696e098c43dde

  • SHA512

    e78a78f2df6f3a66860040afd792bf2e31fe5bf0ade7339d1e7e3d204f71eae16aa0f1bf6d538d139a860720a6b8c8bb2e1ad73de8e44c4b6197d0d1af8a2732

  • SSDEEP

    1536:5ZZZZZZZZZZZZpXzzzzzzzzzzzzV9rXounV98hbHnAEMqqU+2bbbAV2/S2LNmHkD:lBounVyFHFMqqDL2/LgHkc2

Score
10/10
gandcrabbackdoordiscoverypersistenceransomwareupx

Malware Config

Targets

    • Target

      2025-01-27_2b8204770e16986ee516ece9f42e1905_gandcrab

    • Size

      97KB

    • MD5

      2b8204770e16986ee516ece9f42e1905

    • SHA1

      58fb35c99cfc4bdc7effd53c10ad2919171347c3

    • SHA256

      d12d340af223125ba4327dc596c1006c4d77c5008a35fcd10ef696e098c43dde

    • SHA512

      e78a78f2df6f3a66860040afd792bf2e31fe5bf0ade7339d1e7e3d204f71eae16aa0f1bf6d538d139a860720a6b8c8bb2e1ad73de8e44c4b6197d0d1af8a2732

    • SSDEEP

      1536:5ZZZZZZZZZZZZpXzzzzzzzzzzzzV9rXounV98hbHnAEMqqU+2bbbAV2/S2LNmHkD:lBounVyFHFMqqDL2/LgHkc2

    Score
    10/10
    gandcrabbackdoordiscoverypersistenceransomwareupx

    • GandCrab payload

    • Gandcrab

      Gandcrab is a Trojan horse that encrypts files on a computer.

      ransomwarebackdoorgandcrab

    • Gandcrab family

      gandcrab

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks