gandcrab | bb9f3173d448641a9a8562d5e609488b4959f9ea5ed50dab47bd517d851b81fb

Sharing

Copy URL Twitter E-mail

General

Target
bb9f3173d448641a9a8562d5e609488b4959f9ea5ed50dab47bd517d851b81fb
Size 155KB
Sample240525-c62eraca34
SHA256 bb9f3173d448641a9a8562d5e609488b4959f9ea5ed50dab47bd517d851b81fb
MD5 3327aaf1c1fcc21a57a43a50673889cc
SHA1 f3f7da87bf3e04b66c21067c4a92e4da715488d3
SHA512 e8f98b53ca1b9a09f1ec274964119b2060706b5ad2d4c1d6e81c2395d8d1a3f3b89cfa8db943d60c587c4b15d37e38e8409aa33b91facc36cf004068f7bed0fb
SSDEEP 3072:l5K/B0toLQSNJMlZHQsozTS+SMqqDL2/TrKvbG:lcytwtA1yTS+xqqDL6HKa
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gandcrab

Malware Config

Signatures

Detects Reflective DLL injection artifacts 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_ReflectiveLoader

Detects ransomware indicator 1 IoCs

resource	yara_rule
sample	SUSP_RANSOMWARE_Indicator_Jul20

GandCrab payload 1 IoCs

resource	yara_rule
sample	family_gandcrab

Gandcrab Payload 1 IoCs

resource	yara_rule
sample	Gandcrab

Gandcrab family
gandcrab

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bb9f3173d448641a9a8562d5e609488b4959f9ea5ed50dab47bd517d851b81fb

File Explorer

bb9f3173d448641a9a8562d5e609488b4959f9ea5ed50dab47bd517d851b81fb

.exe 155KB

bb9f3173d448641a9a8562d5e609488b4959f9ea5ed50dab47bd517d851b81fb

IMPHASH 7848011b763d00cd02658995847dd30b
SHA256 bb9f3173d448641a9a8562d5e609488b4959f9ea5ed50dab47bd517d851b81fb
MD5 3327aaf1c1fcc21a57a43a50673889cc
SHA1 f3f7da87bf3e04b66c21067c4a92e4da715488d3
SHA512 e8f98b53ca1b9a09f1ec274964119b2060706b5ad2d4c1d6e81c2395d8d1a3f3b89cfa8db943d60c587c4b15d37e38e8409aa33b91facc36cf004068f7bed0fb
SSDEEP 3072:l5K/B0toLQSNJMlZHQsozTS+SMqqDL2/TrKvbG:lcytwtA1yTS+xqqDL6HKa
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Detects Reflective DLL injection artifacts
Detects ransomware indicator
GandCrab payload
Gandcrab Payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5650

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetCurrentProcess WaitForSingleObject OpenProcess Sleep GetModuleFileNameW CreateFileW ExitThread GetLastError GetProcAddress ExitProcess GetModuleHandleA CloseHandle GetCurrentProcessId GetVersionExW LoadLibraryA lstrlenW TerminateThread CreateThread WriteConsoleW SetFilePointerEx VirtualProtect IsWow64Process SetStdHandle GetConsoleMode GetConsoleCP FlushFileBuffers GetCommandLineA SetLastError GetCurrentThreadId EncodePointer DecodePointer GetModuleHandleExW MultiByteToWideChar WideCharToMultiByte GetProcessHeap GetStdHandle GetFileType DeleteCriticalSection GetStartupInfoW GetModuleFileNameA WriteFile QueryPerformanceCounter GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW IsDebuggerPresent IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW EnterCriticalSection LeaveCriticalSection HeapFree IsValidCodePage GetACP GetOEMCP GetCPInfo LoadLibraryExW OutputDebugStringW HeapAlloc HeapReAlloc GetStringTypeW HeapSize LCMapStringW

user32

SetFocus SendMessageW CharUpperBuffW GetForegroundWindow GetSystemMetrics GetMessageW TranslateMessage DispatchMessageW SetForegroundWindow DefWindowProcW RegisterClassExW CreateWindowExW DestroyWindow ShowWindow keybd_event UpdateWindow SetWindowTextW GetWindowLongW SetWindowLongW SystemParametersInfoW GetAncestor

ntdll

RtlUnwind