gandcrab | 21957bfa277e386c9967171dd181723fc9cc63d3ec00e782e72fa9477007c5c5[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
21957bfa277e386c9967171dd181723fc9cc63d3ec00e782e72fa9477007c5c5.exe
Size 69KB
Sample220830-1bdl7scba5
SHA256 21957bfa277e386c9967171dd181723fc9cc63d3ec00e782e72fa9477007c5c5
MD5 41f632e9186aa82ddcf7a80ebecc47e5
SHA1 31fa0d3f068d65ee777d040d093ef145f6d36eb5
SHA512 87ad8877089150cca17fa7d9df6502083127f0884319b5b439763b8c4bb1d82d7d929454178e007a43c387b2916423f5e0b2565dc6666422cb5bb4c75a8de90a
SSDEEP 1536:d555555555555pDf3BrpDz3txh3KciaMqqU+2bbbAV2/S2xr3IdE8mne0Avu5r+y:3/Xr9aaMqqDL2/xr3IdE8we0Avu5r++Z
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gandcrab

Malware Config

Signatures

GandCrab payload 1 IoCs

resource	yara_rule
sample	family_gandcrab

Gandcrab family
gandcrab

File Explorer

21957bfa277e386c9967171dd181723fc9cc63d3ec00e782e72fa9477007c5c5.exe

.exe 69KB

21957bfa277e386c9967171dd181723fc9cc63d3ec00e782e72fa9477007c5c5.exe

IMPHASH 2b4bc2af4d7edfd1476bd09d0ea9def7
SHA256 21957bfa277e386c9967171dd181723fc9cc63d3ec00e782e72fa9477007c5c5
MD5 41f632e9186aa82ddcf7a80ebecc47e5
SHA1 31fa0d3f068d65ee777d040d093ef145f6d36eb5
SHA512 87ad8877089150cca17fa7d9df6502083127f0884319b5b439763b8c4bb1d82d7d929454178e007a43c387b2916423f5e0b2565dc6666422cb5bb4c75a8de90a
SSDEEP 1536:d555555555555pDf3BrpDz3txh3KciaMqqU+2bbbAV2/S2xr3IdE8mne0Avu5r+y:3/Xr9aaMqqDL2/xr3IdE8we0Avu5r++Z
MD5 SHA1 SHA512 SSDEEP

windows x86

GandCrab payload

Minor OS version

Major OS version

Entry point

17595

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFilePointer VirtualFree GetFileAttributesW ReadFile MoveFileW lstrcpyW SetFileAttributesW GetDriveTypeW VerSetConditionMask WaitForSingleObject GetTickCount InitializeCriticalSection OpenProcess GetSystemDirectoryW TerminateThread Sleep TerminateProcess VerifyVersionInfoW WaitForMultipleObjects lstrcmpiW DeleteCriticalSection ExpandEnvironmentStringsW ExitThread SetHandleInformation lstrcatA MultiByteToWideChar CreatePipe lstrcmpiA Process32NextW CreateToolhelp32Snapshot LeaveCriticalSection EnterCriticalSection FindFirstFileW lstrcmpW FindClose FindNextFileW GetNativeSystemInfo GetComputerNameW GetDiskFreeSpaceW GetWindowsDirectoryW GetVolumeInformationW LoadLibraryA CreateThread CloseHandle lstrcatW CreateFileMappingW GetLastError GetTempPathW CreateFileW GetModuleFileNameW WriteFile GetModuleHandleW UnmapViewOfFile MapViewOfFile CreateMutexW GetFileSize GetEnvironmentVariableW lstrcpyA GetModuleHandleA VirtualAlloc Process32FirstW lstrlenW GetProcAddress GetProcessHeap HeapFree HeapAlloc lstrlenA CreateProcessW ExitProcess IsProcessorFeaturePresent

user32

GetMessageW LoadCursorW BeginPaint DestroyWindow TranslateMessage RegisterClassExW LoadIconW SetWindowLongW EndPaint GetForegroundWindow wsprintfW ShowWindow CreateWindowExW SendMessageW DispatchMessageW DefWindowProcW UpdateWindow

gdi32

TextOutW

advapi32

CryptExportKey AllocateAndInitializeSid RegSetValueExW RegCreateKeyExW RegCloseKey CryptAcquireContextW CryptGetKeyParam CryptReleaseContext CryptImportKey CryptEncrypt CryptGenKey CryptDestroyKey GetUserNameW RegQueryValueExW RegOpenKeyExW FreeSid

shell32

SHGetSpecialFolderPathW ShellExecuteW ShellExecuteExW

crypt32

CryptStringToBinaryA CryptBinaryToStringA

wininet

HttpSendRequestW HttpOpenRequestW InternetCloseHandle InternetOpenW InternetConnectW InternetReadFile