Extracted

• • Target

    2025-01-01_34389f7d33dcad9bfc872f5c663e37de_gandcrab

  • Size

    74KB

  • MD5

    34389f7d33dcad9bfc872f5c663e37de

  • SHA1

    31d94fe4ae696802cbfcaf1f4dbf88f9c4ab615b

  • SHA256

    b384c4c92e1742eadf3aca0c31b5437b921f8def2677a102f81025f4d571a333

  • SHA512

    429d15fa7ce0c49aa22d2186e0ef8002f6e3f5dc56bf77e38fffc72d80a670ce7b636bddf9ebeafd10ae6dc3d46db1cc1e8002517b8bd478a6fc5762ba90ca95

  • SSDEEP

    1536:T555555555555pmgSeGDjtQhnwmmB0yJMqqU+2bbbAV2/S2mr3IdE8mne0Avu5ry:UMSjOnrmBxMqqDL2/mr3IdE8we0Avu5h

  Score

  10^/10

  gandcrabbackdoordiscoverypersistenceransomware

  • GandCrab payload

  • Gandcrab

    Gandcrab is a Trojan horse that encrypts files on a computer.

    ransomwarebackdoorgandcrab

  • Gandcrab family

    gandcrab

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2