gandcrab | 2024-04-01_9b103fc57cfeeeff88623575ea0216c0_gandcrab

General

Target

2024-04-01_9b103fc57cfeeeff88623575ea0216c0_gandcrab
Size

147KB
MD5

9b103fc57cfeeeff88623575ea0216c0
SHA1

aaeb8843722a32b3d4baf84761fa4cd13426aac7
SHA256

c00495b4d63a1e7f18a679548e3cad71b19b3c3aec2d1e04e4148037dc808d7f
SHA512

9da25bb74d1160aa83a882d497e31b324a2ae61a4f8067a3410340f061e931e7cf6db6f5e766f71d4ad91429415a5e75a2b84c77d82b5a28c48515d3f224f9de
SSDEEP

3072:WBounVyFHFMqqDL2/LgHkc2U6FiPZ8aewZ2ql5f2J9lj:WqxHmqqDL6EHl2U6CbeOl5f2Fj

Score

10^/10

upx gandcrab

Detects Reflective DLL injection artifacts 1 IoCs

Processes:

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_ReflectiveLoader

Detects ransomware indicator 1 IoCs

Processes:

resource	yara_rule
sample	SUSP_RANSOMWARE_Indicator_Jul20

GandCrab payload 1 IoCs

Processes:

resource yara_rule

sample family_gandcrab
Gandcrab Payload 1 IoCs

Processes:

resource yara_rule

sample Gandcrab
Gandcrab family
gandcrab
UPX dump on OEP (original entry point) 1 IoCs

Processes:

resource yara_rule

sample UPX
UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
upx

Processes:

resource yara_rule

sample upx

resource	yara_rule
sample	family_gandcrab

resource	yara_rule
sample	Gandcrab

resource	yara_rule
sample	UPX

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
2024-04-01_9b103fc57cfeeeff88623575ea0216c0_gandcrab