gandcrab | 2024-05-25_fb1c18903ddf0cde994bd5805f711219_bkransomware_gandcrab_karagany

Sharing

Target
2024-05-25_fb1c18903ddf0cde994bd5805f711219_bkransomware_gandcrab_karagany
Size 141KB
Sample240525-dn1wyace21
SHA256 fbf31fe421181149d2b4e545d59b40a6ab9f6ac9f9a60d9e97cc0320ee46f89c
MD5 fb1c18903ddf0cde994bd5805f711219
SHA1 f03e293562d1181ca483a713e9068d45da11e894
SHA512 4f9f0382d3a02743a03342a1a49360338acb3395f1ba9bc01059f09566dc7818ffea70a0ab114075b5d8f927bee92c74570076002d04a7735407f0e906ec5090
SSDEEP 3072:m5tmM+mBqQHlUs4QL1nMqqDL2/OPvdlz:m5t3Xj4QL1MqqDL6svdlz
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gandcrab

Detects Reflective DLL injection artifacts 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_ReflectiveLoader

Detects ransomware indicator 1 IoCs

resource	yara_rule
sample	SUSP_RANSOMWARE_Indicator_Jul20

GandCrab payload 1 IoCs

resource	yara_rule
sample	family_gandcrab

Gandcrab Payload 1 IoCs

resource	yara_rule
sample	Gandcrab

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-25_fb1c18903ddf0cde994bd5805f711219_bkransomware_gandcrab_karagany

2024-05-25_fb1c18903ddf0cde994bd5805f711219_bkransomware_gandcrab_karagany

.exe 141KB

IMPHASH 7b6dd4245c054681d7b6b1f9b76fe984
SHA256 fbf31fe421181149d2b4e545d59b40a6ab9f6ac9f9a60d9e97cc0320ee46f89c
MD5 fb1c18903ddf0cde994bd5805f711219
SHA1 f03e293562d1181ca483a713e9068d45da11e894
SHA512 4f9f0382d3a02743a03342a1a49360338acb3395f1ba9bc01059f09566dc7818ffea70a0ab114075b5d8f927bee92c74570076002d04a7735407f0e906ec5090
SSDEEP 3072:m5tmM+mBqQHlUs4QL1nMqqDL2/OPvdlz:m5t3Xj4QL1MqqDL6svdlz
MD5 SHA1 SHA512 SSDEEP

Minor OS version

Major OS version

Entry point

5046

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths