Extracted

• • Target

    13005a858b9acc64341375e6a19a4e2103feb5bfcbae6105df3b1dd45c21afccN.exe

  • Size

    254KB

  • MD5

    3a742cdab913d8abddb9a64a8b704860

  • SHA1

    d102b636fe011ca89bfdcf7afaf2390e5da6b67b

  • SHA256

    13005a858b9acc64341375e6a19a4e2103feb5bfcbae6105df3b1dd45c21afcc

  • SHA512

    015a22db93e9769db7b9a3ed2cf51bbd946cf0d96b96b6cf69d1c43284f140ca7a8ef739a31726677b54b53779e3910e82db1e9ef76f382df3930d7f9aeef969

  • SSDEEP

    6144:k3vKbK4vXhTyLWFZpeMarxoUHWOYhAuB:ivKBvXhTyqFLeMarqU+hR

  Score

  10^/10

  gandcrabbackdoordiscoverypersistenceransomware

  • GandCrab payload

  • Gandcrab

    Gandcrab is a Trojan horse that encrypts files on a computer.

    ransomwarebackdoorgandcrab

  • Gandcrab family

    gandcrab

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2