Behavioral task
behavioral1
Sample
32131e40f700acd7e424a7bc1d0ad2be_gandcrab_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
32131e40f700acd7e424a7bc1d0ad2be_gandcrab_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
32131e40f700acd7e424a7bc1d0ad2be_gandcrab_JC.exe
-
Size
252KB
-
MD5
32131e40f700acd7e424a7bc1d0ad2be
-
SHA1
2ff64f6af3673fca961af09d6565e6ace6640524
-
SHA256
ad3718cf09b459c875aa1bed1ead412d5738a9af688a6b7c9d5c9d2711c3ebad
-
SHA512
bbfd4a51fdb6951a0cc72c49445f87f4c0c8e2cc3f50e53d278a8cc23727511b1a1bca14da288fe2f783e3be935c264f546661db2b6f20dcaafea7b2e281ca43
-
SSDEEP
6144:gXjOnr6+qqDL64vdbD3f6mP+pmplO2oS8K:gTOn6qn6cbLf/+oy2oS
Malware Config
Extracted
gandcrab
http://gdcbghvjyqy7jclk.onion.top/
Signatures
-
GandCrab payload 1 IoCs
resource yara_rule sample family_gandcrab -
Gandcrab family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 32131e40f700acd7e424a7bc1d0ad2be_gandcrab_JC.exe
Files
-
32131e40f700acd7e424a7bc1d0ad2be_gandcrab_JC.exe.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 33KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ