gandcrab | 4d13faf4c7eb6086287a8d0b8e05b0f7ab75d8ef9a5d04afc1ec810a9afc311f | Triage

Submit
Reports

Overview

overview

Static

static

2025-04-14...ab.exe

windows10-2004-x64

Sharing

General

Target

2025-04-14_639f33d7ca056b5e7007364c30abb9cb_elex_gandcrab
Size

97KB
Sample

250414-1mrcfasjx4
MD5

639f33d7ca056b5e7007364c30abb9cb
SHA1

3a8fdca05b1bc0921955115ab91af03bf9fc0442
SHA256

4d13faf4c7eb6086287a8d0b8e05b0f7ab75d8ef9a5d04afc1ec810a9afc311f
SHA512

ef735f5518b4d89c38e6e8b9f4268d6e5dd354f9b5f05f14d39dd080ec93a9b32feafd61586510abe59839a1d030cc1f150486d6fd3e997f754d4969f486b848
SSDEEP

1536:VZZZZZZZZZZZZpXzzzzzzzzzzzzV9rXounV98hbHnAEMqqU+2bbbAV2/S2LNmHkD:pBounVyFHFMqqDL2/LgHkc2

Score

10^/10

gandcrab backdoor discovery persistence ransomware upx

Static task

static1

4 signatures

Behavioral task

behavioral1

Sample

2025-04-14_639f33d7ca056b5e7007364c30abb9cb_elex_gandcrab.exe

Resource

win10v2004-20250410-en

gandcrab backdoor discovery persistence ransomware upx

windows10-2004-x64

10 signatures

150 seconds

Malware Config

Targets

- Target
  
  2025-04-14_639f33d7ca056b5e7007364c30abb9cb_elex_gandcrab
- Size
  
  97KB
- MD5
  
  639f33d7ca056b5e7007364c30abb9cb
- SHA1
  
  3a8fdca05b1bc0921955115ab91af03bf9fc0442
- SHA256
  
  4d13faf4c7eb6086287a8d0b8e05b0f7ab75d8ef9a5d04afc1ec810a9afc311f
- SHA512
  
  ef735f5518b4d89c38e6e8b9f4268d6e5dd354f9b5f05f14d39dd080ec93a9b32feafd61586510abe59839a1d030cc1f150486d6fd3e997f754d4969f486b848
- SSDEEP
  
  1536:VZZZZZZZZZZZZpXzzzzzzzzzzzzV9rXounV98hbHnAEMqqU+2bbbAV2/S2LNmHkD:pBounVyFHFMqqDL2/LgHkc2
Score

10^/10

gandcrab backdoor discovery persistence ransomware upx
- GandCrab payload
- Gandcrab
  Gandcrab is a Trojan horse that encrypts files on a computer.
  ransomware backdoor gandcrab
- Gandcrab family
  gandcrab
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gandcrabbackdoordiscoverypersistenceransomwareupx

© 2018-2025

Terms | Privacy

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.