Overview

overview

8

Static

static

3

GANG-Nuker/GANG.exe

windows10-2004-x64

8

GANG-Nuker/GANG.exe

windows11-ltsc_2024-x64

7

GANG-Nuker...ker.py

windows10-2004-x64

3

GANG-Nuker...ker.py

windows11-ltsc_2024-x64

3

GANG-Nuker...gin.py

windows10-2004-x64

3

GANG-Nuker...gin.py

windows11-ltsc_2024-x64

3

GANG-Nuker...ter.py

windows10-2004-x64

3

GANG-Nuker...ter.py

windows11-ltsc_2024-x64

3

GANG-Nuker...ber.py

windows10-2004-x64

3

GANG-Nuker...ber.py

windows11-ltsc_2024-x64

8

GANG-Nuker...kup.py

windows10-2004-x64

3

GANG-Nuker...kup.py

windows11-ltsc_2024-x64

3

GANG-Nuker...nfo.py

windows10-2004-x64

3

GANG-Nuker...nfo.py

windows11-ltsc_2024-x64

3

GANG-Nuker...ore.py

windows10-2004-x64

3

GANG-Nuker...ore.py

windows11-ltsc_2024-x64

3

GANG-Nuker...mon.py

windows10-2004-x64

3

GANG-Nuker...mon.py

windows11-ltsc_2024-x64

3

GANG-Nuker...rys.py

windows10-2004-x64

3

GANG-Nuker...rys.py

windows11-ltsc_2024-x64

3

GANG-Nuker...ate.py

windows10-2004-x64

3

GANG-Nuker...ate.py

windows11-ltsc_2024-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    GANG-Nuker.zip
  • Size 119.6MB
  • Sample260620-exhmdsc17k
  • SHA256 502b2bfc63c501480abe0209a1ad8889fba1903571d92da7b57990e2eee8b672
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarepersistencepyinstallerransomwarespyware

Malware Config

Targets

    • Target
      GANG-Nuker/GANG.exe
    • Size 120.3MB
    • SHA256 2f44de5a3a84543ecc843d0e1af4770e1b7c7417e431c3d6b6ad011e50d30644
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Contacts third-party web service commonly abused for C2

      Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

    behavioral1behavioral2
    • Target
      GANG-Nuker/utilities/Plugins/Account_Nuker.py
    • Size 5KB
    • SHA256 22048ee9d20120554b817d6292caeee2336604270f3d7f84947e4db4ea4fdcad
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    behavioral3behavioral4
    • Target
      GANG-Nuker/utilities/Plugins/Auto_Login.py
    • Size 2KB
    • SHA256 e9a3d79a5c3216e169a1451c6e899085940f72f94fe263ecd3a9739f4c650b1f
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    behavioral5behavioral6
    • Target
      GANG-Nuker/utilities/Plugins/DM_Deleter.py
    • Size 688B
    • SHA256 5cd19808a91cbe40e89a2de9ff24d153b81d022179dbe4c3b23d0474ce3e8e96
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    behavioral7behavioral8
    • Target
      GANG-Nuker/utilities/Plugins/QR_Grabber.py
    • Size 7KB
    • SHA256 ed80578d80f6828f88badeb3c3b74720fd76233eb823b786f6cfe5ee308d62b3
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    adwarepersistenceransomwarespyware

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral10behavioral9
    • Target
      GANG-Nuker/utilities/Plugins/Server_Lookup.py
    • Size 2KB
    • SHA256 a55a516416c59294be36cfae89ab848c7339db53c138416c9b1fe9b62d93815e
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    behavioral11behavioral12
    • Target
      GANG-Nuker/utilities/Plugins/Token_Info.py
    • Size 6KB
    • SHA256 e5b89869e7d0873c8c34a5ffe8a78b5ca0414a8a3bfcb91e46cf8322b6a68231
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    behavioral13behavioral14
    • Target
      GANG-Nuker/utilities/Plugins/ignore/ignore.py
    • Size 15B
    • SHA256 9f2ebe4ee8506911c79d986221dde75966f3628e4cb0ab8bc7832b6a1e5cfaea
    • MD5 SHA1 SHA512
    Score
    3/10
    behavioral15behavioral16
    • Target
      GANG-Nuker/utilities/Settings/common.py
    • Size 16KB
    • SHA256 a44a1c3133a6dac1e882c2e4409d3d5d270b281e282b86d85f22a2138c8b1855
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    behavioral17behavioral18
    • Target
      GANG-Nuker/utilities/Settings/libarys.py
    • Size 5KB
    • SHA256 df597e1bccf9909ead31a2c9b4c535021eb12b5f8a1a0c607a4630fd1e9c9aca
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    behavioral19behavioral20
    • Target
      GANG-Nuker/utilities/Settings/update.py
    • Size 5KB
    • SHA256 4272ea902df70571c3d862a50258604b65907fa68fed8b5b607b204763759774
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    behavioral21behavioral22

MITRE ATT&CK Enterprise v16

Tasks