General
-
Target
https://github.com/topics/malware-samples
-
Sample
250409-wq725symz6
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://github.com/topics/malware-samples
Resource
win11-20250313-en
Malware Config
Extracted
C:\$Recycle.Bin\EFZUBVNRQ-DECRYPT.txt
http://gandcrabmfe6mnef.onion/2a581c84442e9e29
Targets
-
-
Target
https://github.com/topics/malware-samples
-
Gandcrab family
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (332) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Downloads MZ/PE file
-
Credentials from Password Stores: Windows Credential Manager
Suspicious access to Credentials History.
-
Drops startup file
-
Executes dropped EXE
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Legitimate hosting services abused for malware hosting/C2
-
Sets desktop wallpaper using registry
-
MITRE ATT&CK Enterprise v16
Defense Evasion
Indicator Removal
1File Deletion
1Modify Registry
1Subvert Trust Controls
1SIP and Trust Provider Hijacking
1