gandcrab | 1e5a1cadac4802d37b760e4027e9bbb9037b1384ac0a5a7e613f4b8e603f4162 | Triage

Sharing

General

Target

2025-03-25_747895c02b26445eb8e71d3df5d0a6e2_gandcrab
Size

70KB
Sample

250325-1rq78swrs9
MD5

747895c02b26445eb8e71d3df5d0a6e2
SHA1

b9c13944a1ddea8a191033695c82eab3218960ae
SHA256

1e5a1cadac4802d37b760e4027e9bbb9037b1384ac0a5a7e613f4b8e603f4162
SHA512

59b70e544071833c02f1a3c3f79f31337e5b76d255f5092408be90a3c7c9720e941247034a4fa946295271f1970ab5a0782f0416d3b7c97c9b3938a1e3657d90
SSDEEP

1536:3ZZZZZZZZZZZZpXzzzzzzzzzzzzADypczUk+lkZJngWMqqU+2bbbAV2/S2OvvdZl:ed5BJHMqqDL2/Ovvdr

Score

10^/10

gandcrab discovery persistence

Malware Config

Targets

- Target
  
  2025-03-25_747895c02b26445eb8e71d3df5d0a6e2_gandcrab
- Size
  
  70KB
- MD5
  
  747895c02b26445eb8e71d3df5d0a6e2
- SHA1
  
  b9c13944a1ddea8a191033695c82eab3218960ae
- SHA256
  
  1e5a1cadac4802d37b760e4027e9bbb9037b1384ac0a5a7e613f4b8e603f4162
- SHA512
  
  59b70e544071833c02f1a3c3f79f31337e5b76d255f5092408be90a3c7c9720e941247034a4fa946295271f1970ab5a0782f0416d3b7c97c9b3938a1e3657d90
- SSDEEP
  
  1536:3ZZZZZZZZZZZZpXzzzzzzzzzzzzADypczUk+lkZJngWMqqU+2bbbAV2/S2OvvdZl:ed5BJHMqqDL2/Ovvdr
Score

6^/10

discovery persistence
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence