Extracted

• • Target

    47a26c6d43fa1b7b27002e11ffa7787f9e3a770ba7d0c6e3adece1097f6bc3f0

  • Size

    32KB

  • MD5

    e5d523e923c1f4abe7bf3d3b8c284646

  • SHA1

    30e80deb7554d0a94da181d2c0c6a260b25af8ec

  • SHA256

    47a26c6d43fa1b7b27002e11ffa7787f9e3a770ba7d0c6e3adece1097f6bc3f0

  • SHA512

    326c350dabb169c0ee9b96510bf267c72bd303564bdd8f8116d2a2c18699fbc72c1b92eef48dae5aec8a3803983fd75175fc72e3404d6d7dcda6d341cb009d59

  • SSDEEP

    768:Zq27qnSLVl6IxWciTJsKqDjyOQegL7H7ucNVxEGi19OI9U+F2:ZNqSBlTWci1sKwjyOO7hNLFU9pq7

  Score

  10^/10

  gandcrabbackdoorpersistenceransomware

  • GandCrab payload

  • Gandcrab

    Gandcrab is a Trojan horse that encrypts files on a computer.

    ransomwarebackdoorgandcrab

  • Detects ransomware indicator

  • Gandcrab Payload

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2