gandcrab | 172c71fb303c80e3e88c54f5b71c98044a2190dc8e4f1440ee17113ef12e3d12

General

Target
172c71fb303c80e3e88c54f5b71c98044a2190dc8e4f1440ee17113ef12e3d12
Size 155KB
Sample240525-c3fc4sbg72
SHA256 172c71fb303c80e3e88c54f5b71c98044a2190dc8e4f1440ee17113ef12e3d12
MD5 2fd625d1d43376a8b39c5b491458649b
SHA1 19702e119718240a2f491a0f2453613557ca00c2
SHA512 a1e5e16b48fb101a892d08e4b3ff11f6f1ded193609a02405a621295d8c36026eb6e1df80d85735f3a380c5b5c69767602eede84b1d377c64ca8b02ea5c44424
SSDEEP 3072:l5K/B0toLQSNJQlZHQsozTS+SMqqDL2/TrKhpG:lcytwtg1yTS+xqqDL6HKa
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gandcrab

Malware Config

Signatures

GandCrab payload 1 IoCs

resource	yara_rule
sample	family_gandcrab

Gandcrab family
gandcrab

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
172c71fb303c80e3e88c54f5b71c98044a2190dc8e4f1440ee17113ef12e3d12

File Explorer

172c71fb303c80e3e88c54f5b71c98044a2190dc8e4f1440ee17113ef12e3d12

.exe 155KB

172c71fb303c80e3e88c54f5b71c98044a2190dc8e4f1440ee17113ef12e3d12

IMPHASH 7848011b763d00cd02658995847dd30b
SHA256 172c71fb303c80e3e88c54f5b71c98044a2190dc8e4f1440ee17113ef12e3d12
MD5 2fd625d1d43376a8b39c5b491458649b
SHA1 19702e119718240a2f491a0f2453613557ca00c2
SHA512 a1e5e16b48fb101a892d08e4b3ff11f6f1ded193609a02405a621295d8c36026eb6e1df80d85735f3a380c5b5c69767602eede84b1d377c64ca8b02ea5c44424
SSDEEP 3072:l5K/B0toLQSNJQlZHQsozTS+SMqqDL2/TrKhpG:lcytwtg1yTS+xqqDL6HKa
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

GandCrab payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

5650

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetCurrentProcess WaitForSingleObject OpenProcess Sleep GetModuleFileNameW CreateFileW ExitThread GetLastError GetProcAddress ExitProcess GetModuleHandleA CloseHandle GetCurrentProcessId GetVersionExW LoadLibraryA lstrlenW TerminateThread CreateThread WriteConsoleW SetFilePointerEx VirtualProtect IsWow64Process SetStdHandle GetConsoleMode GetConsoleCP FlushFileBuffers GetCommandLineA SetLastError GetCurrentThreadId EncodePointer DecodePointer GetModuleHandleExW MultiByteToWideChar WideCharToMultiByte GetProcessHeap GetStdHandle GetFileType DeleteCriticalSection GetStartupInfoW GetModuleFileNameA WriteFile QueryPerformanceCounter GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW IsDebuggerPresent IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW EnterCriticalSection LeaveCriticalSection HeapFree IsValidCodePage GetACP GetOEMCP GetCPInfo LoadLibraryExW OutputDebugStringW HeapAlloc HeapReAlloc GetStringTypeW HeapSize LCMapStringW

user32

SetFocus SendMessageW CharUpperBuffW GetForegroundWindow GetSystemMetrics GetMessageW TranslateMessage DispatchMessageW SetForegroundWindow DefWindowProcW RegisterClassExW CreateWindowExW DestroyWindow ShowWindow keybd_event UpdateWindow SetWindowTextW GetWindowLongW SetWindowLongW SystemParametersInfoW GetAncestor

ntdll

RtlUnwind

Sharing