General
-
Target
2025-02-04_24065b8ee2f59431f5d227cf619d7965_mafia
-
Size
219KB
-
Sample
250204-b63gdasncq
-
MD5
24065b8ee2f59431f5d227cf619d7965
-
SHA1
523be526b80b0216bf1fe46dfb9391cf3f0576a0
-
SHA256
7f61eda7f9a77d6a594354ef8fbe92ad8f5aff8a696468a80c47ea3e9f640826
-
SHA512
b01f878d2507211606bb02cecd386b2d8cfd2922ede94fadb8199826f4174d0406cfb4f77d822022a55b5f5971c89a52604b22086f34e8c078f358aceb737621
-
SSDEEP
3072:7ZMTthZ1HyTpSmJhbE0sYVQYAfF0Cq3KXB4mKVTNp4qYNu5nm+5XBNMYEmZ:7ZMLtmJ2056790CqivKVjnYNsB
Static task
static1
Behavioral task
behavioral1
Sample
2025-02-04_24065b8ee2f59431f5d227cf619d7965_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2025-02-04_24065b8ee2f59431f5d227cf619d7965_mafia.exe
Resource
win10v2004-20250129-en
Malware Config
Extracted
F:\$RECYCLE.BIN\KRAB-DECRYPT.txt
http://gandcrabmfe6mnef.onion/5ee0c36badf74d9e
Extracted
F:\$RECYCLE.BIN\S-1-5-21-2436272344-4274332273-444425594-1000\KRAB-DECRYPT.txt
http://gandcrabmfe6mnef.onion/25ed709baf92b44b
Targets
-
-
Target
2025-02-04_24065b8ee2f59431f5d227cf619d7965_mafia
-
Size
219KB
-
MD5
24065b8ee2f59431f5d227cf619d7965
-
SHA1
523be526b80b0216bf1fe46dfb9391cf3f0576a0
-
SHA256
7f61eda7f9a77d6a594354ef8fbe92ad8f5aff8a696468a80c47ea3e9f640826
-
SHA512
b01f878d2507211606bb02cecd386b2d8cfd2922ede94fadb8199826f4174d0406cfb4f77d822022a55b5f5971c89a52604b22086f34e8c078f358aceb737621
-
SSDEEP
3072:7ZMTthZ1HyTpSmJhbE0sYVQYAfF0Cq3KXB4mKVTNp4qYNu5nm+5XBNMYEmZ:7ZMLtmJ2056790CqivKVjnYNsB
-
Gandcrab family
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (313) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Credentials from Password Stores: Windows Credential Manager
Suspicious access to Credentials History.
-
Drops startup file
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1