Extracted

• • Target

    2025-01-01_8dc00cec838c38b8949106b13904fee2_gandcrab

  • Size

    74KB

  • MD5

    8dc00cec838c38b8949106b13904fee2

  • SHA1

    d1f86825e211d8a3108d062708f4aeb86fd3c479

  • SHA256

    64288b9a27164d82015f9dd944d935ede9ff94fc25331d006060ff4fa0d4e06c

  • SHA512

    ce1ce9c598f82c88ecd07a1ec0ae1271fae0648ec91187127e75977abb5a569ff2784f78d854570be27addabc6e5d6fea58e0e9b1662fa0b1df1384a0cb72990

  • SSDEEP

    1536:N55u555555555pmgSeGDjtQhnwmmB0ybMqqU+2bbbAV2/S2mr3IdE8mne0Avu5rJ:lMSjOnrmBTMqqDL2/mr3IdE8we0Avu5F

  Score

  10^/10

  gandcrabbackdoordiscoverypersistenceransomware

  • GandCrab payload

  • Gandcrab

    Gandcrab is a Trojan horse that encrypts files on a computer.

    ransomwarebackdoorgandcrab

  • Gandcrab family

    gandcrab

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2