gandcrab | d888556feb8ff459f3c7058285c403f850100fff7c7f4370a0f76231f1ce8d02 | Triage

Sharing

General

Target

2025-04-10_f35bd0c15502d1a1f81ad76cf13d68bc_elex_gandcrab
Size

76KB
Sample

250410-fbvkha1qt5
MD5

f35bd0c15502d1a1f81ad76cf13d68bc
SHA1

11523e1b5ffe768acf6e3c40311c2c6737fbf93e
SHA256

d888556feb8ff459f3c7058285c403f850100fff7c7f4370a0f76231f1ce8d02
SHA512

a2d2a3a341bee99b0f10ece179ef4fd304c6c23d04465a82d2c3180bf0de20f99bf5e04a691457902b090d7ee5718a8b74428cd3bf45ea5830e78e1d0c4a2f44
SSDEEP

1536:JZZZZZZZZZZZZpXzzzzzzzzzzzzV9rXounV98hbHnAwfMqqU+2bbbAV2/S2Lkvdf:1BounVyFHpfMqqDL2/Lkvdf

Score

10^/10

gandcrab discovery persistence

Malware Config

Targets

- Target
  
  2025-04-10_f35bd0c15502d1a1f81ad76cf13d68bc_elex_gandcrab
- Size
  
  76KB
- MD5
  
  f35bd0c15502d1a1f81ad76cf13d68bc
- SHA1
  
  11523e1b5ffe768acf6e3c40311c2c6737fbf93e
- SHA256
  
  d888556feb8ff459f3c7058285c403f850100fff7c7f4370a0f76231f1ce8d02
- SHA512
  
  a2d2a3a341bee99b0f10ece179ef4fd304c6c23d04465a82d2c3180bf0de20f99bf5e04a691457902b090d7ee5718a8b74428cd3bf45ea5830e78e1d0c4a2f44
- SSDEEP
  
  1536:JZZZZZZZZZZZZpXzzzzzzzzzzzzV9rXounV98hbHnAwfMqqU+2bbbAV2/S2Lkvdf:1BounVyFHpfMqqDL2/Lkvdf
Score

6^/10

discovery persistence
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence