General
-
Target
2025-02-04_24065b8ee2f59431f5d227cf619d7965_mafia
-
Size
219KB
-
Sample
250325-stn7na1rw5
-
MD5
24065b8ee2f59431f5d227cf619d7965
-
SHA1
523be526b80b0216bf1fe46dfb9391cf3f0576a0
-
SHA256
7f61eda7f9a77d6a594354ef8fbe92ad8f5aff8a696468a80c47ea3e9f640826
-
SHA512
b01f878d2507211606bb02cecd386b2d8cfd2922ede94fadb8199826f4174d0406cfb4f77d822022a55b5f5971c89a52604b22086f34e8c078f358aceb737621
-
SSDEEP
3072:7ZMTthZ1HyTpSmJhbE0sYVQYAfF0Cq3KXB4mKVTNp4qYNu5nm+5XBNMYEmZ:7ZMLtmJ2056790CqivKVjnYNsB
Static task
static1
Behavioral task
behavioral1
Sample
2025-02-04_24065b8ee2f59431f5d227cf619d7965_mafia.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
2025-02-04_24065b8ee2f59431f5d227cf619d7965_mafia.exe
Resource
win10v2004-20250314-en
Malware Config
Extracted
F:\$RECYCLE.BIN\KRAB-DECRYPT.txt
http://gandcrabmfe6mnef.onion/acad4a9e6eff3df8
Extracted
C:\$Recycle.Bin\KRAB-DECRYPT.txt
http://gandcrabmfe6mnef.onion/180f7e60a1edf10c
Targets
-
-
Target
2025-02-04_24065b8ee2f59431f5d227cf619d7965_mafia
-
Size
219KB
-
MD5
24065b8ee2f59431f5d227cf619d7965
-
SHA1
523be526b80b0216bf1fe46dfb9391cf3f0576a0
-
SHA256
7f61eda7f9a77d6a594354ef8fbe92ad8f5aff8a696468a80c47ea3e9f640826
-
SHA512
b01f878d2507211606bb02cecd386b2d8cfd2922ede94fadb8199826f4174d0406cfb4f77d822022a55b5f5971c89a52604b22086f34e8c078f358aceb737621
-
SSDEEP
3072:7ZMTthZ1HyTpSmJhbE0sYVQYAfF0Cq3KXB4mKVTNp4qYNu5nm+5XBNMYEmZ:7ZMLtmJ2056790CqivKVjnYNsB
-
Gandcrab family
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (295) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Credentials from Password Stores: Windows Credential Manager
Suspicious access to Credentials History.
-
Drops startup file
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
MITRE ATT&CK Enterprise v15
Defense Evasion
Indicator Removal
1File Deletion
1Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1