gandcrab | 2024-05-24_72d22d93098e3f56de2220c605c678e0_bkransomware_gandcrab_karagany

Sharing

Target
2024-05-24_72d22d93098e3f56de2220c605c678e0_bkransomware_gandcrab_karagany
Size 143KB
Sample240524-3rh8qsfc8w
SHA256 0766f1a56e41386cf7abac049f8e85e9d516634a600185d5de418c495ee30cdc
MD5 72d22d93098e3f56de2220c605c678e0
SHA1 9ec2195dd9c033711bd89353669bd1ad9d79de30
SHA512 8e8987c4f96a290e0919ea552541f4ee49b00f91eb93ed68c9c2f2bcd7cebdeb793680ccdc56575dc59d1a181e387f79c548aec9cc91c89cadc6e9d98830e253
SSDEEP 3072:o+HcL2RCfTTntqSQRruiMZMqqDL2/Awvdd7Vjp9:hyDtORruiMyqqDL6tvdfp9
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gandcrab

Detects Reflective DLL injection artifacts 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_ReflectiveLoader

Detects ransomware indicator 1 IoCs

resource	yara_rule
sample	SUSP_RANSOMWARE_Indicator_Jul20

GandCrab payload 1 IoCs

resource	yara_rule
sample	family_gandcrab

Gandcrab Payload 1 IoCs

resource	yara_rule
sample	Gandcrab

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-24_72d22d93098e3f56de2220c605c678e0_bkransomware_gandcrab_karagany

2024-05-24_72d22d93098e3f56de2220c605c678e0_bkransomware_gandcrab_karagany

.exe 143KB

IMPHASH 4b0a5cb1aa0992ea9901768198fd3e7e
SHA256 0766f1a56e41386cf7abac049f8e85e9d516634a600185d5de418c495ee30cdc
MD5 72d22d93098e3f56de2220c605c678e0
SHA1 9ec2195dd9c033711bd89353669bd1ad9d79de30
SHA512 8e8987c4f96a290e0919ea552541f4ee49b00f91eb93ed68c9c2f2bcd7cebdeb793680ccdc56575dc59d1a181e387f79c548aec9cc91c89cadc6e9d98830e253
SSDEEP 3072:o+HcL2RCfTTntqSQRruiMZMqqDL2/Awvdd7Vjp9:hyDtORruiMyqqDL6tvdfp9
MD5 SHA1 SHA512 SSDEEP

Minor OS version

Major OS version

Entry point

5448

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths