Extracted

• • Target

    7664cef37123a8fe0fb8b582726c2ae03dc40cb9da93378de5943c3dff502264N.exe

  • Size

    257KB

  • MD5

    b23905b4282935b7d9a18eb22521ea10

  • SHA1

    3be108a50baebe9f23cf030177def3d070c30b20

  • SHA256

    7664cef37123a8fe0fb8b582726c2ae03dc40cb9da93378de5943c3dff502264

  • SHA512

    7eb0014416cfe7fec1228a01c6e7f3769ffe4cafc7bde2f46750a2d0c6bc11188f66e0b9acc1ac189828dc50cd5395b4f41ca59ae9884c8801f535490174adbb

  • SSDEEP

    6144:fBHOi8kPkx28MBr+WuwyD5v4PKMPq6IqAkPtv3b1GGWyok:ftOipkx28MBy/wyDBUdokzGGWyok

  Score

  10^/10

  gandcrabbackdoordiscoverypersistenceransomware

  • GandCrab payload

  • Gandcrab

    Gandcrab is a Trojan horse that encrypts files on a computer.

    ransomwarebackdoorgandcrab

  • Gandcrab family

    gandcrab

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2