Static task
static1
Behavioral task
behavioral1
Sample
2024-03-31_9398a48cf72789589a138523db985bfd_gandcrab_karagany.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-03-31_9398a48cf72789589a138523db985bfd_gandcrab_karagany.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-31_9398a48cf72789589a138523db985bfd_gandcrab_karagany
-
Size
177KB
-
MD5
9398a48cf72789589a138523db985bfd
-
SHA1
2ef7592a83aa17ac6cbe88925602cd0488f8687d
-
SHA256
04e82f8adcfb9924bc07eec99c8de442d7af00377344b5f33528dca8d9ca304b
-
SHA512
51ae1ed3d46acbdbab25eaed90e500c19fb9d00ae986aa2bd3ca4f00fc9a9a3679c6fa38bc8d3c3dc83385c9b94dc4ed607b2136d156b6510809e690238ff153
-
SSDEEP
3072:ixgidvBOyONJMjNP9Fgz/z98PtM7JARKcFw40kio4eY+ykU02dbt9i+lAbHVzgWa:iui/OyONWjvBP1RKheUkU02746Ab1zgz
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 2024-03-31_9398a48cf72789589a138523db985bfd_gandcrab_karagany
Files
-
2024-03-31_9398a48cf72789589a138523db985bfd_gandcrab_karagany.exe windows:5 windows x86 arch:x86
eab30870a6e1236da19419cc3f5cb6ca
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetTapeStatus
FreeUserPhysicalPages
FindAtomA
SetLocaleInfoW
EraseTape
VirtualProtect
Module32NextW
TlsAlloc
GetConsoleSelectionInfo
CloseHandle
CreateFileW
GetProcAddress
FlushFileBuffers
HeapReAlloc
HeapAlloc
GetStringTypeW
LCMapStringW
IsProcessorFeaturePresent
WriteConsoleW
SetStdHandle
RtlUnwind
MultiByteToWideChar
Sleep
SetThreadPriority
LoadLibraryW
GetPrivateProfileIntA
SetCommBreak
CreateJobObjectW
GetCPInfo
GetStringTypeA
lstrlenA
HeapSize
FileTimeToDosDateTime
HeapFree
IsValidCodePage
GetOEMCP
GetACP
GetCommandLineW
HeapSetInformation
GetStartupInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
DecodePointer
TerminateProcess
GetCurrentProcess
EnterCriticalSection
LeaveCriticalSection
GetModuleHandleW
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
GetLastError
InterlockedDecrement
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
user32
SetWindowContextHelpId
ToAsciiEx
EnumPropsW
GetKeyNameTextA
ReplyMessage
CreateDesktopA
DlgDirSelectExA
WindowFromPoint
DrawEdge
GetClassLongA
DrawFocusRect
GetUpdateRect
GetWindowPlacement
CreateWindowExA
GetWindowContextHelpId
GetActiveWindow
EqualRect
SystemParametersInfoA
SetWindowTextA
GetMonitorInfoW
ActivateKeyboardLayout
gdi32
SetMetaFileBitsEx
CreateColorSpaceA
RectInRegion
GdiSetBatchLimit
GetMapMode
CreateFontIndirectExW
GetTextAlign
GetTextExtentExPointA
GetTextMetricsW
winspool.drv
DeviceCapabilitiesA
msimg32
TransparentBlt
Sections
.text Size: 46KB - Virtual size: 46KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 652KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 107KB - Virtual size: 107KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ