gandcrab | af83d326623222714d958200656c7d6ef7301c4dde34d801023bc23a0461f4d9 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

2025-01-23...ab.exe

windows7-x64

2025-01-23...ab.exe

windows10-2004-x64

Sharing

General

Target

2025-01-23_1f197dd6aab58a202f02907b5ffdcf90_gandcrab
Size

72KB
Sample

250123-v6vajsyncr
MD5

1f197dd6aab58a202f02907b5ffdcf90
SHA1

06fb37414f9e7791d85ac02d6c452fe1fabef40b
SHA256

af83d326623222714d958200656c7d6ef7301c4dde34d801023bc23a0461f4d9
SHA512

068b97e1537e5e2f6b805e62a37f3ad9b42c11d554de941b675dcb5df688e810d139696067f074816b10a6bf27f3050def2e272e8e07b9d278f5fbc036a7d576
SSDEEP

768:GBIxo9TZkKXN7VfiFohEJH5co/iej2JWOkKgTiGMqWNUMFAHJ9E3lvd6s:2Ixo9TNXy9coqlWOkKgdMqqUM2Lkvd6

Score

10^/10

gandcrab backdoor discovery persistence ransomware

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

2025-01-23_1f197dd6aab58a202f02907b5ffdcf90_gandcrab.exe

Resource

win7-20240903-en

gandcrab backdoor discovery persistence ransomware

windows7-x64

9 signatures

150 seconds

Behavioral task

behavioral2

Sample

2025-01-23_1f197dd6aab58a202f02907b5ffdcf90_gandcrab.exe

Resource

win10v2004-20241007-en

gandcrab backdoor discovery persistence ransomware

windows10-2004-x64

9 signatures

150 seconds

Malware Config

Targets

- Target
  
  2025-01-23_1f197dd6aab58a202f02907b5ffdcf90_gandcrab
- Size
  
  72KB
- MD5
  
  1f197dd6aab58a202f02907b5ffdcf90
- SHA1
  
  06fb37414f9e7791d85ac02d6c452fe1fabef40b
- SHA256
  
  af83d326623222714d958200656c7d6ef7301c4dde34d801023bc23a0461f4d9
- SHA512
  
  068b97e1537e5e2f6b805e62a37f3ad9b42c11d554de941b675dcb5df688e810d139696067f074816b10a6bf27f3050def2e272e8e07b9d278f5fbc036a7d576
- SSDEEP
  
  768:GBIxo9TZkKXN7VfiFohEJH5co/iej2JWOkKgTiGMqWNUMFAHJ9E3lvd6s:2Ixo9TNXy9coqlWOkKgdMqqUM2Lkvd6
Score

10^/10

gandcrab backdoor discovery persistence ransomware
- GandCrab payload
- Gandcrab
  Gandcrab is a Trojan horse that encrypts files on a computer.
  ransomware backdoor gandcrab
- Gandcrab family
  gandcrab
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gandcrabbackdoordiscoverypersistenceransomware

behavioral2

gandcrabbackdoordiscoverypersistenceransomware

© 2018-2025

Terms | Privacy

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.