Behavioral task
behavioral1
Sample
2023-04-25_4103c3e848062e4fb64a05b97bf16caf_gandcrab.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
2023-04-25_4103c3e848062e4fb64a05b97bf16caf_gandcrab.exe
Resource
win10v2004-20230220-en
General
-
Target
2023-04-25_4103c3e848062e4fb64a05b97bf16caf_gandcrab
-
Size
7.7MB
-
MD5
4103c3e848062e4fb64a05b97bf16caf
-
SHA1
76681d8529e7686e5ff8442a972d95ba8c1a92e2
-
SHA256
91e74b6c5b418697457b3d5a7298ab3f581e5a7861e06b6ccc95af4393561cba
-
SHA512
1022c414d492911962bb501dafc277d3c58a8cad989ca2f0f872cc19430b12097fecc4162e9b2aa78a805a34697188e2466c0136251a0453b057c7fb2da23835
-
SSDEEP
6144:lcytwbI1yTS+xqqDL6HK2WebH3rYK3z1:CyiI1Rqn6q2WebXkk
Malware Config
Signatures
-
GandCrab payload 1 IoCs
resource yara_rule sample family_gandcrab -
Gandcrab family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2023-04-25_4103c3e848062e4fb64a05b97bf16caf_gandcrab
Files
-
2023-04-25_4103c3e848062e4fb64a05b97bf16caf_gandcrab.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 50KB - Virtual size: 50KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 81KB - Virtual size: 88KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ