gandcrab | 2024-05-26_802f74fba9bdd1f0b3601f09a018a68c_bkransomware_gandcrab_karagany

Sharing

Target
2024-05-26_802f74fba9bdd1f0b3601f09a018a68c_bkransomware_gandcrab_karagany
Size 143KB
Sample240526-hcvm1aaa8w
SHA256 5b4afc4bb17a065a79e1fd3a8378d750dc4e3db88bcec92e0030018354f198dc
MD5 802f74fba9bdd1f0b3601f09a018a68c
SHA1 f10ed156340ef8f4627ae175aa9274678edcaf41
SHA512 6c29f175e184156d01ddd888773d542763966d4d758c0f6435ce19bc2889ca69e6d3b6dd59abe787184e3d33037d33055f3100c09b58d8cb59682010a06c7bc2
SSDEEP 3072:o+HcL2WCfhTntqSQRruiMZMqqDL2/AwvdG7Vjp9:hfDtORruiMyqqDL6tvdsp9
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gandcrab

Detects Reflective DLL injection artifacts 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_ReflectiveLoader

Detects ransomware indicator 1 IoCs

resource	yara_rule
sample	SUSP_RANSOMWARE_Indicator_Jul20

GandCrab payload 1 IoCs

resource	yara_rule
sample	family_gandcrab

Gandcrab Payload 1 IoCs

resource	yara_rule
sample	Gandcrab

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-26_802f74fba9bdd1f0b3601f09a018a68c_bkransomware_gandcrab_karagany

2024-05-26_802f74fba9bdd1f0b3601f09a018a68c_bkransomware_gandcrab_karagany

.exe 143KB

IMPHASH 4b0a5cb1aa0992ea9901768198fd3e7e
SHA256 5b4afc4bb17a065a79e1fd3a8378d750dc4e3db88bcec92e0030018354f198dc
MD5 802f74fba9bdd1f0b3601f09a018a68c
SHA1 f10ed156340ef8f4627ae175aa9274678edcaf41
SHA512 6c29f175e184156d01ddd888773d542763966d4d758c0f6435ce19bc2889ca69e6d3b6dd59abe787184e3d33037d33055f3100c09b58d8cb59682010a06c7bc2
SSDEEP 3072:o+HcL2WCfhTntqSQRruiMZMqqDL2/AwvdG7Vjp9:hfDtORruiMyqqDL6tvdsp9
MD5 SHA1 SHA512 SSDEEP

Minor OS version

Major OS version

Entry point

5448

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths