Extracted

Extracted

• • Target
    2026-05-03_aa628df8564ddea05e686aca16c80ba1_akira_elex_glassworm
  • Size 17.1MB
  • SHA256 f943c5ef2fc3183307bf9ea8dc84d046830e1d700f5adf15f3d6ef6f5b9912f4
  • MD5 aa628df8564ddea05e686aca16c80ba1
  • SHA1 4898dcd9c8a7a25f261a2757f4f6d919201ada81
  • SHA512 4706839ee0e8f68f612b659eb3f505607586574e5d2d14616c209b1ce71205a69ef32d812f5c493b04cad2d663d2bd00489059df1e19ab79fc38afe6adfb915e
  • SSDEEP 393216:SfVJ6BVJ6BVJ6BVJ6BVJ6BVJ6BVJ6BVJ6BVJ6BVJ6BVJ6BVJ6BVJ6BVJ6BVJ6BVY:ouuuuuuuuuuuuuuuY
  • TLSH
    T10807233AF5420B0FCA7AA7F192BDE225B458194410024D77A6DE8CF13B5FBA513E852F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoorcredential_accessdefense_evasiondiscoveryexecutiongandcrabimpactransomwarespywarestealer

  • Family: Gandcrab

    Gandcrab is a Trojan horse that encrypts files on a computer.

    ransomwarebackdoorgandcrab

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Detects ransomware indicator

  • Enumerates VirtualBox DLL files

  • Enumerates VirtualBox registry keys

    defense_evasion

  • Gandcrab Payload

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Looks for VirtualBox Guest Additions in registry

    defense_evasion

  • Looks for VirtualBox drivers on disk

    defense_evasion

  • Renames multiple (480) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Looks for VMWare Tools registry key

    defense_evasion

  • Looks for VMWare drivers on disk

    defense_evasion

  • Looks for VMWare services registry key.

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Drops startup file

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2