gandcrab | 32aef2cf549319a3a9cd0f80e5c982f7bf86742e64c474e16e972ea9e5e3e7fc | Triage

Submit
Reports

Overview

overview

Static

static

32aef2cf54...fc.exe

windows7-x64

32aef2cf54...fc.exe

windows10-2004-x64

Sharing

General

Target

32aef2cf549319a3a9cd0f80e5c982f7bf86742e64c474e16e972ea9e5e3e7fc
Size

97KB
Sample

241024-1e5vvsvdqe
MD5

913ac3d033146f1d347c88ef8779820e
SHA1

850977547ca824bd9235d1b5180e1bfb3a1a51e6
SHA256

32aef2cf549319a3a9cd0f80e5c982f7bf86742e64c474e16e972ea9e5e3e7fc
SHA512

9bfa11f20f334093a7172fc7451d738adedde1c1819876ed94f72fbce3a317df4c64a2bef01d33c976650f51b8e10067e411cf6cff65d5aafd9c6b5c323d2315
SSDEEP

1536:pZZZZZZZZZZZZpXzzzzzzzzzzzzV9rXounV98hbHnAlMqqU+2bbbAV2/S2LNmHkf:VBounVyFHkMqqDL2/LgHkctc

Score

10^/10

gandcrab backdoor discovery persistence ransomware upx

Static task

static1

4 signatures

Behavioral task

behavioral1

Sample

32aef2cf549319a3a9cd0f80e5c982f7bf86742e64c474e16e972ea9e5e3e7fc.exe

Resource

win7-20240903-en

gandcrab backdoor discovery persistence ransomware upx

windows7-x64

9 signatures

150 seconds

Behavioral task

behavioral2

Sample

32aef2cf549319a3a9cd0f80e5c982f7bf86742e64c474e16e972ea9e5e3e7fc.exe

Resource

win10v2004-20241007-en

gandcrab backdoor discovery persistence ransomware upx

windows10-2004-x64

9 signatures

150 seconds

Malware Config

Targets

- Target
  
  32aef2cf549319a3a9cd0f80e5c982f7bf86742e64c474e16e972ea9e5e3e7fc
- Size
  
  97KB
- MD5
  
  913ac3d033146f1d347c88ef8779820e
- SHA1
  
  850977547ca824bd9235d1b5180e1bfb3a1a51e6
- SHA256
  
  32aef2cf549319a3a9cd0f80e5c982f7bf86742e64c474e16e972ea9e5e3e7fc
- SHA512
  
  9bfa11f20f334093a7172fc7451d738adedde1c1819876ed94f72fbce3a317df4c64a2bef01d33c976650f51b8e10067e411cf6cff65d5aafd9c6b5c323d2315
- SSDEEP
  
  1536:pZZZZZZZZZZZZpXzzzzzzzzzzzzV9rXounV98hbHnAlMqqU+2bbbAV2/S2LNmHkf:VBounVyFHkMqqDL2/LgHkctc
Score

10^/10

gandcrab backdoor discovery persistence ransomware upx
- GandCrab payload
- Gandcrab
  Gandcrab is a Trojan horse that encrypts files on a computer.
  ransomware backdoor gandcrab
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gandcrabbackdoordiscoverypersistenceransomwareupx

behavioral2

gandcrabbackdoordiscoverypersistenceransomwareupx

© 2018-2025

Terms | Privacy