gandcrab | 2026-06-30_6ec0ab317f13c69f2f25dc8707866fd6_bkransomware_elex_gandcrab_maze

General

Target
2026-06-30_6ec0ab317f13c69f2f25dc8707866fd6_bkransomware_elex_gandcrab_maze
Size 16.5MB
Sample260701-e3dkmags9v
SHA256 18143ef6fa19e7424958290465583d04d7b897201a3d236932bbe230c71c9a7e
MD5 6ec0ab317f13c69f2f25dc8707866fd6
SHA1 81b5defe457414b13a5c743758307e1409c057be
SHA512 a6ab883d6b488b3196518bf10b97a61c00c2786716c4556706355b944eda1a0feb2f31a7828f142540c0e5ef4fd78a5db744eb15ea95b8350d2b0496c7008fff
SSDEEP 6144:+xYSg9FTTSdBgQqqDL6SKn7nh4AdKxRtj9f2XwseH:+xYZ9FTqn6rn7+AdKxRlV2AH
TLSH
T1A9077D81A9F3C5FAF2E68E7C41746B14882D3C125F2475DF65A782CB9A127924F39B03
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

ransomware backdoor gandcrab

Malware Config

Signatures

Family: Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
ransomware backdoor gandcrab

Detects Reflective DLL injection artifacts 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_ReflectiveLoader

GandCrab payload 1 IoCs

resource	yara_rule
sample	family_gandcrab

Gandcrab Payload 1 IoCs

resource	yara_rule
sample	Gandcrab

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-30_6ec0ab317f13c69f2f25dc8707866fd6_bkransomware_elex_gandcrab_maze

File Explorer

2026-06-30_6ec0ab317f13c69f2f25dc8707866fd6_bkransomware_elex_gandcrab_maze

.exe 16.5MB

2026-06-30_6ec0ab317f13c69f2f25dc8707866fd6_bkransomware_elex_gandcrab_maze

IMPHASH 7848011b763d00cd02658995847dd30b
SHA256 18143ef6fa19e7424958290465583d04d7b897201a3d236932bbe230c71c9a7e
MD5 6ec0ab317f13c69f2f25dc8707866fd6
SHA1 81b5defe457414b13a5c743758307e1409c057be
SHA512 a6ab883d6b488b3196518bf10b97a61c00c2786716c4556706355b944eda1a0feb2f31a7828f142540c0e5ef4fd78a5db744eb15ea95b8350d2b0496c7008fff
SSDEEP 6144:+xYSg9FTTSdBgQqqDL6SKn7nh4AdKxRtj9f2XwseH:+xYZ9FTqn6rn7+AdKxRlV2AH
TLSH
T1A9077D81A9F3C5FAF2E68E7C41746B14882D3C125F2475DF65A782CB9A127924F39B03
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Detects Reflective DLL injection artifacts
GandCrab payload
Gandcrab Payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

5650

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetCurrentProcess WaitForSingleObject OpenProcess Sleep GetModuleFileNameW CreateFileW ExitThread GetLastError GetProcAddress ExitProcess GetModuleHandleA CloseHandle GetCurrentProcessId GetVersionExW LoadLibraryA lstrlenW TerminateThread CreateThread WriteConsoleW SetFilePointerEx VirtualProtect IsWow64Process SetStdHandle GetConsoleMode GetConsoleCP FlushFileBuffers GetCommandLineA SetLastError GetCurrentThreadId EncodePointer DecodePointer GetModuleHandleExW MultiByteToWideChar WideCharToMultiByte GetProcessHeap GetStdHandle GetFileType DeleteCriticalSection GetStartupInfoW GetModuleFileNameA WriteFile QueryPerformanceCounter GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW IsDebuggerPresent IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW EnterCriticalSection LeaveCriticalSection HeapFree IsValidCodePage GetACP GetOEMCP GetCPInfo LoadLibraryExW OutputDebugStringW HeapAlloc HeapReAlloc GetStringTypeW HeapSize LCMapStringW

user32

SetFocus SendMessageW CharUpperBuffW GetForegroundWindow GetSystemMetrics GetMessageW TranslateMessage DispatchMessageW SetForegroundWindow DefWindowProcW RegisterClassExW CreateWindowExW DestroyWindow ShowWindow keybd_event UpdateWindow SetWindowTextW GetWindowLongW SetWindowLongW SystemParametersInfoW GetAncestor

ntdll

RtlUnwind

Sharing