Extracted

• • Target

    2025-01-01_3fa8955b6cbf296a8d000307977c5106_gandcrab

  • Size

    74KB

  • MD5

    3fa8955b6cbf296a8d000307977c5106

  • SHA1

    2737d97b2fcae2072301adf92ea9cdea2266754f

  • SHA256

    8d38d3b92a2276cb52c2cff153f3ea16a95818d34a70faf7b3996fa4d5b8e3f5

  • SHA512

    7b609e04940b128cf0dfabe65c4796f88d6b742e6bdb3853f4153191fb26f9767fdd27ad61b385b46cadd24ee1eb1c00e6685c40de0a84243855e3f214597559

  • SSDEEP

    1536:GgSeGDjtQhnwmmB0yjMqqUM2mr3IdE8mne0Avu5r++yy7CA7GcIaapavdv:GMSjOnrmBbMqqMmr3IdE8we0Avu5r++N

  Score

  10^/10

  gandcrabbackdoordiscoverypersistenceransomware

  • GandCrab payload

  • Gandcrab

    Gandcrab is a Trojan horse that encrypts files on a computer.

    ransomwarebackdoorgandcrab

  • Gandcrab family

    gandcrab

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2