Extracted

• • Target

    2025-01-01_59384f9b8ccbae1fafdd9cae70f5cb79_gandcrab

  • Size

    74KB

  • MD5

    59384f9b8ccbae1fafdd9cae70f5cb79

  • SHA1

    e7deb19a605fb6a770c3abf6e08faa142b47ad08

  • SHA256

    939c7612586b2dd11cffbb95f3b22ba188f16a4dd767272c8723dffbc8e922eb

  • SHA512

    322ab00597d80357a5b97b2cd4394be8fd15640c42b88549a75e606d95c0ceeff1601da8190d3e18bc4ba7b3231abd7dc3f1f4ecc8837cef0ad39042672476b8

  • SSDEEP

    1536:O555555555555pmgSeGDjtQhnwmmB0yJMqqU+2bbbAV2/S2mr3IdE8mne0Avu5ry:/MSjOnrmBxMqqDL2/mr3IdE8we0Avu5h

  Score

  10^/10

  gandcrabbackdoordiscoverypersistenceransomware

  • GandCrab payload

  • Gandcrab

    Gandcrab is a Trojan horse that encrypts files on a computer.

    ransomwarebackdoorgandcrab

  • Gandcrab family

    gandcrab

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2