gandcrab | 2024-05-25_c7bdcd8fdc1b65748afb2e62d9c8424f_bkransomware_gandcrab_karagany

Sharing

Target
2024-05-25_c7bdcd8fdc1b65748afb2e62d9c8424f_bkransomware_gandcrab_karagany
Size 143KB
Sample240525-3wrexafg67
SHA256 d6f01dd47a843728d15f43127991b19971a0607833f858dfa632149d850a033d
MD5 c7bdcd8fdc1b65748afb2e62d9c8424f
SHA1 c1b76bc07c66df62708cc750c63c47b432898909
SHA512 860962e1a0ef1775e3f1cee2e9600c3c38818adac73d6aa34f7163e917e39b09423a395638b13a57086b162c552aecde9bf0caab30d814d2b6c76d7968dbc58a
SSDEEP 3072:o+HcL2ICfGTntqSQRruiMZMqqDL2/Awvdf7Vjp9:hODtORruiMyqqDL6tvd1p9
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gandcrab

Detects Reflective DLL injection artifacts 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_ReflectiveLoader

Detects ransomware indicator 1 IoCs

resource	yara_rule
sample	SUSP_RANSOMWARE_Indicator_Jul20

GandCrab payload 1 IoCs

resource	yara_rule
sample	family_gandcrab

Gandcrab Payload 1 IoCs

resource	yara_rule
sample	Gandcrab

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-25_c7bdcd8fdc1b65748afb2e62d9c8424f_bkransomware_gandcrab_karagany

2024-05-25_c7bdcd8fdc1b65748afb2e62d9c8424f_bkransomware_gandcrab_karagany

.exe 143KB

IMPHASH 4b0a5cb1aa0992ea9901768198fd3e7e
SHA256 d6f01dd47a843728d15f43127991b19971a0607833f858dfa632149d850a033d
MD5 c7bdcd8fdc1b65748afb2e62d9c8424f
SHA1 c1b76bc07c66df62708cc750c63c47b432898909
SHA512 860962e1a0ef1775e3f1cee2e9600c3c38818adac73d6aa34f7163e917e39b09423a395638b13a57086b162c552aecde9bf0caab30d814d2b6c76d7968dbc58a
SSDEEP 3072:o+HcL2ICfGTntqSQRruiMZMqqDL2/Awvdf7Vjp9:hODtORruiMyqqDL6tvd1p9
MD5 SHA1 SHA512 SSDEEP

Minor OS version

Major OS version

Entry point

5448

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths