Extracted

• • Target
    jaffacakes118_Trojan.NSIS.Inject.rnn.c677c326168aac424820a36d7b83df9b
  • Size 374KB
  • SHA256 46b6d9d284accad6ed3106eb2651cfbf350242523ff1a41bb0585b47f71e5b06
  • MD5 c677c326168aac424820a36d7b83df9b
  • SHA1 e93de597761d91fc609e5246a1514eacc3c4dcd1
  • SHA512 c8f843a451abd0b5c0846e386d77b456179b22877c7430fc635b69ab0a5fa68d54041600c2c7d6f5388131a61e989c57f45e9231de8a94989868fe6afd54683d
  • SSDEEP 6144:acpnM51pcOKTzwiRTLsGe15WehLIppFfPl6duYREwgacXxZ+pd8lM10lVmhRr:acNCcOwzOGi9PUcEwgacXxoPKM10lU7
  • TLSH
    T1E284120461B45427F5F60E720EB58726DFBB7D221C30C6595384EE1E3E36B12EE26B4A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoorcredential_accessdefense_evasiondiscoveryexecutiongandcrabimpactpersistenceprivilege_escalationransomwarespywarestealer

  • Family: Gandcrab

    Gandcrab is a Trojan horse that encrypts files on a computer.

    ransomwarebackdoorgandcrab

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Renames multiple (659) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry

    ransomware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 11KB
  • SHA256 a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7
  • MD5 75ed96254fbf894e42058062b4b4f0d1
  • SHA1 996503f1383b49021eb3427bc28d13b5bbd11977
  • SHA512 58174896db81d481947b8745dafe3a02c150f3938bb4543256e8cce1145154e016d481df9fe68dac6d48407c62cbe20753320ebd5fe5e84806d07ce78e0eb0c4
  • SSDEEP 192:X24sihno0bW+l97H4GB7QDs91kMtwtobTr4u+QHbazMNHT7dmNIEr:m8vJl97JeoxtN/r3z7YV
  • TLSH
    T1E0327D1293E044F2F191853C086B3B5AAB7A65099BE24EA79FE381817D15AD6BD3D303
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral3behavioral4
• • Target
    $TEMP/gladiator.dll
  • Size 216KB
  • SHA256 33ab92d51cf8a1901e2cbfcf3d432b508bb07d94edfa8e1f94985c808bb632dd
  • MD5 c0fa146fa77f33ba4aca523a30e8ae0e
  • SHA1 4f514af1f10abff7169bcc3df3bfbae42fb480ed
  • SHA512 c70954442e6518ba3fc29738dbaccacd492a3448b9e3a92a3918f380c923ea69d9746777320fa547fc460e5a31ad97507d20a7bcd4b3aefd2bde7fd96a1a9c19
  • SSDEEP 3072:xm283B6CsLw1CoY2IbZboqMpy8qkGHmE2vv8G1jEaMVuQwGI+NSSytt6W93AW:xmjyU1fnINc9oJzq0G1jEaIwGbNpWG
  • TLSH
    T1D8244A25BBC4FDA1E56E847235B2EBE10466F0F24A5F5A027B800F8D653129EDE35B07
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral5behavioral6