gandcrab | 89efdf2c79fc817b316b962daaf0d274e8eec1a88cb1bcd8555df9196bef5137 | Triage

Sharing

General

Target

2025-01-28_3564feb85053aa99f9da5f9f00cbd189_gandcrab
Size

72KB
Sample

250128-2a6f9swmdk
MD5

3564feb85053aa99f9da5f9f00cbd189
SHA1

44fd56baa7bde934b40ac118fc0256224f72ef1f
SHA256

89efdf2c79fc817b316b962daaf0d274e8eec1a88cb1bcd8555df9196bef5137
SHA512

7ce144319a5eb1d1cb99ad09e9ca7c726956325f0f0a117ef174e07508bb47f1549b2c5a4364110514e9aaba753f2f96f22fdb3a29ac48579499ccc8645464f3
SSDEEP

1536:zzzzzzzzzV9rXourVf8hbHnAXMqqUM2Lkvd6ubC:xBourVkFHCMqqMLkvd

Score

10^/10

gandcrab backdoor discovery persistence ransomware

Malware Config

Targets

- Target
  
  2025-01-28_3564feb85053aa99f9da5f9f00cbd189_gandcrab
- Size
  
  72KB
- MD5
  
  3564feb85053aa99f9da5f9f00cbd189
- SHA1
  
  44fd56baa7bde934b40ac118fc0256224f72ef1f
- SHA256
  
  89efdf2c79fc817b316b962daaf0d274e8eec1a88cb1bcd8555df9196bef5137
- SHA512
  
  7ce144319a5eb1d1cb99ad09e9ca7c726956325f0f0a117ef174e07508bb47f1549b2c5a4364110514e9aaba753f2f96f22fdb3a29ac48579499ccc8645464f3
- SSDEEP
  
  1536:zzzzzzzzzV9rXourVf8hbHnAXMqqUM2Lkvd6ubC:xBourVkFHCMqqMLkvd
Score

10^/10

gandcrab backdoor discovery persistence ransomware
- GandCrab payload
- Gandcrab
  Gandcrab is a Trojan horse that encrypts files on a computer.
  ransomware backdoor gandcrab
- Gandcrab family
  gandcrab
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gandcrabbackdoordiscoverypersistenceransomware

behavioral2

gandcrabbackdoordiscoverypersistenceransomware