gandcrab | 2024-01-25_ee41bf4bcb43f1192bd9fbf40d8b605d_gandcrab

General

Target

2024-01-25_ee41bf4bcb43f1192bd9fbf40d8b605d_gandcrab
Size

147KB
MD5

ee41bf4bcb43f1192bd9fbf40d8b605d
SHA1

5711eddc7be8db02b855183ab0bbd42d249cad44
SHA256

7fe68809da53c661a887d491e376681b0517d04ac3a705cb8c2fe5e2c699fec0
SHA512

0a9c92c7b767ade448bf07b11f31b7f87350ede6f24f68a74dc0242f32d6e9018527a70fa2f1402af2615a2f842458cf3d54c82560c456e3565cab68ec15e059
SSDEEP

3072:NBounVyFHFMqqDL2/LgHkc2U6FiPZ8aewZ2ql5f2J9lj:NqxHmqqDL6EHl2U6CbeOl5f2Fj

Score

10^/10

upx gandcrab

Detects Reflective DLL injection artifacts 1 IoCs

Processes:

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_ReflectiveLoader

Detects ransomware indicator 1 IoCs

Processes:

resource	yara_rule
sample	SUSP_RANSOMWARE_Indicator_Jul20

GandCrab payload 1 IoCs

Processes:

resource yara_rule

sample family_gandcrab
Gandcrab Payload 1 IoCs

Processes:

resource yara_rule

sample Gandcrab
Gandcrab family
gandcrab
UPX dump on OEP (original entry point) 1 IoCs

Processes:

resource yara_rule

sample UPX
UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
upx

Processes:

resource yara_rule

sample upx

resource	yara_rule
sample	family_gandcrab

resource	yara_rule
sample	Gandcrab

resource	yara_rule
sample	UPX

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
2024-01-25_ee41bf4bcb43f1192bd9fbf40d8b605d_gandcrab