General
-
Target
2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab
-
Size
147KB
-
Sample
240125-s8lebaaac7
-
MD5
b9cdd427a4f6b44e19cfdf85fbdf5820
-
SHA1
1dbedf3118e87c1a77de8aa807b51e5d2c3e938e
-
SHA256
2934f2415bd25a562d6185c49588e559b4fa6862ee6bb4d8bd04ad3a9937c545
-
SHA512
9e6939868024373db20557bb95f29500159ef25519f35e66688cfb474e9fd1533d8fa0178f21b287ec77e6bbacc31f06fde3219bda51659e9b035b5bc39c92a9
-
SSDEEP
3072:xBounVyFHFMqqDL2/LgHkc2U6FiPZ8aewZ2ql5f2J9lj:xqxHmqqDL6EHl2U6CbeOl5f2Fj
Behavioral task
behavioral1
Sample
2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe
Resource
win10v2004-20231215-en
Malware Config
Targets
-
-
Target
2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab
-
Size
147KB
-
MD5
b9cdd427a4f6b44e19cfdf85fbdf5820
-
SHA1
1dbedf3118e87c1a77de8aa807b51e5d2c3e938e
-
SHA256
2934f2415bd25a562d6185c49588e559b4fa6862ee6bb4d8bd04ad3a9937c545
-
SHA512
9e6939868024373db20557bb95f29500159ef25519f35e66688cfb474e9fd1533d8fa0178f21b287ec77e6bbacc31f06fde3219bda51659e9b035b5bc39c92a9
-
SSDEEP
3072:xBounVyFHFMqqDL2/LgHkc2U6FiPZ8aewZ2ql5f2J9lj:xqxHmqqDL6EHl2U6CbeOl5f2Fj
-
GandCrab payload
-
Detects Reflective DLL injection artifacts
-
Detects ransomware indicator
-
Gandcrab Payload
-
UPX dump on OEP (original entry point)
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-