gandcrab | 9932e5949fdc062b3c12769a6e5236e4f5caa40f0c966b879f5a306f0670ee52

Sharing

Copy URL Twitter E-mail

General

Target
9932e5949fdc062b3c12769a6e5236e4f5caa40f0c966b879f5a306f0670ee52
Size 109KB
Sample240621-bqwnwsvblb
SHA256 9932e5949fdc062b3c12769a6e5236e4f5caa40f0c966b879f5a306f0670ee52
MD5 d3537fec0b0ca4e6ae6f91b85b15c1d5
SHA1 ade90a54d16ccca3c8d2c4c25a2ede4786c7c368
SHA512 1298d94ca3c2671d43fdfcae62aa0886f43a3c9908ec0dc2ab64989f9f66aeab93b33d06060c2619081c676afd4f6980c70322a5a93cb1f9dea396e0b9fb5126
SSDEEP 3072:HMSjOnrmBIMqqDL2/mr3IdE8we0Avu5r++ygLIaaypQ8CrS6C:HXjOnr6jqqDL6aprYS6C
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

upx gandcrab

Malware Config

Extracted

Family

gandcrab

http://gdcbghvjyqy7jclk.onion.top/

Signatures

Detects ransomware indicator 1 IoCs

resource	yara_rule
sample	SUSP_RANSOMWARE_Indicator_Jul20

GandCrab payload 1 IoCs

resource	yara_rule
sample	family_gandcrab

Gandcrab Payload 1 IoCs

resource	yara_rule
sample	Gandcrab

Gandcrab family
gandcrab

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9932e5949fdc062b3c12769a6e5236e4f5caa40f0c966b879f5a306f0670ee52

File Explorer

9932e5949fdc062b3c12769a6e5236e4f5caa40f0c966b879f5a306f0670ee52

.exe 109KB

9932e5949fdc062b3c12769a6e5236e4f5caa40f0c966b879f5a306f0670ee52

SHA256 9932e5949fdc062b3c12769a6e5236e4f5caa40f0c966b879f5a306f0670ee52
MD5 d3537fec0b0ca4e6ae6f91b85b15c1d5
SHA1 ade90a54d16ccca3c8d2c4c25a2ede4786c7c368
SHA512 1298d94ca3c2671d43fdfcae62aa0886f43a3c9908ec0dc2ab64989f9f66aeab93b33d06060c2619081c676afd4f6980c70322a5a93cb1f9dea396e0b9fb5126
SSDEEP 3072:HMSjOnrmBIMqqDL2/mr3IdE8we0Avu5r++ygLIaaypQ8CrS6C:HXjOnr6jqqDL6aprYS6C
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Detects ransomware indicator
GandCrab payload
Gandcrab Payload
UPX dump on OEP (original entry point)
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

19184

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths