gandcrab | d7db27fbc0721000c168e3bf726bb9bd7f10c18c7ed49d3618e6b31e50191ac9 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

1

RNSM00408.7z

windows10-2004-x64

Sharing

General

Target

RNSM00408.7z
Size

30.3MB
Sample

241028-ytp2vawdke
MD5

487d488a75593b71d0fc2b45a1f7d730
SHA1

fa9519a8b9f19146202340447fe8a4575dec4677
SHA256

d7db27fbc0721000c168e3bf726bb9bd7f10c18c7ed49d3618e6b31e50191ac9
SHA512

e0147341d939b6f108da49322017faf10b621cdf190b7ba1d2a986aace5caed931cf8617b29415c46af47e755654b54ce88bb84edd22f086d21095f169a280d9
SSDEEP

786432:LK/D9g7EtZFDeJQZWIaFA4W2LKU12ZOGuTmvWBeOtMbXQ/:GBDtZEZFzV9NuWg4MbXi

Score

10^/10

gandcrab xorist aspackv2 backdoor discovery ransomware themida upx

Static task

static1

Behavioral task

behavioral1

Sample

RNSM00408.7z

Resource

win10v2004-20241007-en

gandcrab xorist aspackv2 backdoor discovery ransomware themida upx

windows10-2004-x64

23 signatures

300 seconds

Malware Config

Targets

- Target
  
  RNSM00408.7z
- Size
  
  30.3MB
- MD5
  
  487d488a75593b71d0fc2b45a1f7d730
- SHA1
  
  fa9519a8b9f19146202340447fe8a4575dec4677
- SHA256
  
  d7db27fbc0721000c168e3bf726bb9bd7f10c18c7ed49d3618e6b31e50191ac9
- SHA512
  
  e0147341d939b6f108da49322017faf10b621cdf190b7ba1d2a986aace5caed931cf8617b29415c46af47e755654b54ce88bb84edd22f086d21095f169a280d9
- SSDEEP
  
  786432:LK/D9g7EtZFDeJQZWIaFA4W2LKU12ZOGuTmvWBeOtMbXQ/:GBDtZEZFzV9NuWg4MbXi
Score

10^/10

gandcrab xorist aspackv2 backdoor discovery ransomware themida upx
- Detected Xorist Ransomware
- GandCrab payload
- Gandcrab
  Gandcrab is a Trojan horse that encrypts files on a computer.
  ransomware backdoor gandcrab
- Gandcrab family
  gandcrab
- Xorist Ransomware
  Xorist is a ransomware first seen in 2020.
  ransomware xorist
- Xorist family
  xorist
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Executes dropped EXE
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Legitimate hosting services abused for malware hosting/C2
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

gandcrabxoristaspackv2backdoordiscoveryransomwarethemidaupx

© 2018-2025

Terms | Privacy

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.