GandCrab Ransomware Distribution Begins in Korea - ASEC BLOG
Tags
attack-pattern: | Malware - T1587.001 Malware - T1588.001 Software - T1592.002 Vulnerabilities - T1588.006 |
Common Information
Type | Value |
---|---|
UUID | 93d21fcc-1869-44c5-8b89-171a61d64c32 |
Fingerprint | d79608d555d2f6db |
Analysis status | DONE |
Considered CTI value | 0 |
Text language | |
Published | Feb. 8, 2018, midnight |
Added to db | Sept. 11, 2022, 4:59 p.m. |
Last updated | Nov. 17, 2024, 6:54 p.m. |
Headline | GandCrab Ransomware Distribution Begins in Korea |
Title | GandCrab Ransomware Distribution Begins in Korea - ASEC BLOG |
Detected Hints/Tags/Attributes | 60/1/63 |
Source URLs
Redirection | Url | |
---|---|---|
Details | Source | https://asec.ahnlab.com/en/17196/ |
URL Provider
Attributes
Details | Type | #Events | CTI | Value |
---|---|---|---|---|
Details | File | 3 | gdcb-decrypt.txt |
|
Details | File | 46 | msftesql.exe |
|
Details | File | 58 | sqlagent.exe |
|
Details | File | 62 | sqlbrowser.exe |
|
Details | File | 119 | sqlservr.exe |
|
Details | File | 66 | sqlwriter.exe |
|
Details | File | 67 | oracle.exe |
|
Details | File | 57 | ocssd.exe |
|
Details | File | 61 | dbsnmp.exe |
|
Details | File | 57 | synctime.exe |
|
Details | File | 57 | mydesktopqos.exe |
|
Details | File | 57 | agntsvc.exe |
|
Details | File | 54 | isqlplussvc.exe |
|
Details | File | 56 | xfssvccon.exe |
|
Details | File | 60 | mydesktopservice.exe |
|
Details | File | 57 | ocautoupds.exe |
|
Details | File | 57 | encsvc.exe |
|
Details | File | 41 | firefoxconfig.exe |
|
Details | File | 55 | tbirdconfig.exe |
|
Details | File | 57 | ocomm.exe |
|
Details | File | 57 | mysqld.exe |
|
Details | File | 43 | mysqld-nt.exe |
|
Details | File | 40 | mysqld-opt.exe |
|
Details | File | 58 | dbeng50.exe |
|
Details | File | 55 | sqbcoreservice.exe |
|
Details | File | 199 | excel.exe |
|
Details | File | 52 | infopath.exe |
|
Details | File | 91 | msaccess.exe |
|
Details | File | 102 | mspub.exe |
|
Details | File | 74 | onenote.exe |
|
Details | File | 173 | outlook.exe |
|
Details | File | 92 | powerpnt.exe |
|
Details | File | 99 | steam.exe |
|
Details | File | 58 | thebat.exe |
|
Details | File | 35 | thebat64.exe |
|
Details | File | 63 | thunderbird.exe |
|
Details | File | 86 | visio.exe |
|
Details | File | 323 | winword.exe |
|
Details | File | 90 | wordpad.exe |
|
Details | File | 119 | avp.exe |
|
Details | File | 53 | ekrn.exe |
|
Details | File | 14 | avgnt.exe |
|
Details | File | 13 | ashdisp.exe |
|
Details | File | 3 | nortonantibot.exe |
|
Details | File | 45 | mcshield.exe |
|
Details | File | 9 | avengine.exe |
|
Details | File | 23 | cmdagent.exe |
|
Details | File | 10 | smc.exe |
|
Details | File | 9 | persfw.exe |
|
Details | File | 5 | pccpfw.exe |
|
Details | File | 6 | fsguiexe.exe |
|
Details | File | 15 | cfp.exe |
|
Details | File | 198 | msmpeng.exe |
|
Details | File | 196 | desktop.ini |
|
Details | File | 243 | autorun.inf |
|
Details | File | 193 | ntuser.dat |
|
Details | File | 101 | iconcache.db |
|
Details | File | 99 | bootsect.bak |
|
Details | File | 120 | boot.ini |
|
Details | File | 100 | ntuser.dat.log |
|
Details | File | 143 | thumbs.db |
|
Details | Windows Registry Key | 1 | HKCUSOFTWAREMicrosoftWindowsCurrentVersionRunOnce |
|
Details | Windows Registry Key | 3 | HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce |