gandcrab | 588a297aeda8a5e748cb254b49b422b220151603fbb0446f2d18282dc800677f | Triage

Sharing

General

Target

2025-01-28_385d91cf6bed5b07b56d01559c8b258a_gandcrab
Size

70KB
Sample

250128-x5jtjaypfv
MD5

385d91cf6bed5b07b56d01559c8b258a
SHA1

508000fbd738280133b6d6d8dc2c3ccccce77c4d
SHA256

588a297aeda8a5e748cb254b49b422b220151603fbb0446f2d18282dc800677f
SHA512

520af456bd0abaa83fcc6dc50ad518cbca034e8714a122cdd9250a10ae4736290cd12e3e5656248eb9272eb8a1fcccbdcfdf16a0d80a583e451363218f986438
SSDEEP

1536:zZZZZZZZZZZZZpXzzzzzzzzzzzzADypczUk+lkZJngWMqqU+2bbbAV2/S2OvvdZM:id5BJHMqqDL2/Ovvdr+

Score

10^/10

gandcrab discovery persistence

Malware Config

Targets

- Target
  
  2025-01-28_385d91cf6bed5b07b56d01559c8b258a_gandcrab
- Size
  
  70KB
- MD5
  
  385d91cf6bed5b07b56d01559c8b258a
- SHA1
  
  508000fbd738280133b6d6d8dc2c3ccccce77c4d
- SHA256
  
  588a297aeda8a5e748cb254b49b422b220151603fbb0446f2d18282dc800677f
- SHA512
  
  520af456bd0abaa83fcc6dc50ad518cbca034e8714a122cdd9250a10ae4736290cd12e3e5656248eb9272eb8a1fcccbdcfdf16a0d80a583e451363218f986438
- SSDEEP
  
  1536:zZZZZZZZZZZZZpXzzzzzzzzzzzzADypczUk+lkZJngWMqqU+2bbbAV2/S2OvvdZM:id5BJHMqqDL2/Ovvdr+
Score

6^/10

discovery persistence
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence