gandcrab | 3d0c86a5a98c935592c136a0ebea22be344c10dcd2674438bc37e92337bb451f | Triage

Sharing

General

Target

3d0c86a5a98c935592c136a0ebea22be344c10dcd2674438bc37e92337bb451f
Size

69KB
MD5

30d3a374032ae49b3fe51a26491aeb7a
SHA1

1439525db8cac84c917ec84b8171287f80925c50
SHA256

3d0c86a5a98c935592c136a0ebea22be344c10dcd2674438bc37e92337bb451f
SHA512

3073adfb211df33c5496960ab21f62577cf4bd3d09b8334921dfe0188d6e4914f0e9671d0673203642fd00d1ce42e9f76105b1ed3aaf43a680ef704f4648e9b6
SSDEEP

1536:eZZZZZZZZZZZZpXzzzzzzzzzzzzV9rXounV98hbHnAmMqqU+2bbbAV2/S2Lccu:oBounVyFHjMqqDL2/Lcc

Score

10^/10

gandcrab

Malware Config

Signatures

GandCrab Payload 1 IoCs

Processes:

resource yara_rule

sample family_gandcrab
Gandcrab family
gandcrab

Files

3d0c86a5a98c935592c136a0ebea22be344c10dcd2674438bc37e92337bb451f
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Exports

Exports

_ReflectiveLoader@0

Sections

.text
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ