gandcrab | 2026-08-22_144d4ba1d563ee96b9cc81b9b11956b6_coinminer_elex_gandcrab

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-22_144d4ba1d563ee96b9cc81b9b11956b6_coinminer_elex_gandcrab
Size 97KB
Sample260823-pgmxaa1wft
SHA256 8ad43622627aa6f97f65d8563217ef3085f3dfb0fa1e248152eb7204bee3fe0f
MD5 144d4ba1d563ee96b9cc81b9b11956b6
SHA1 4dfc70359907fad1cac899d30712287dc9df5b17
SHA512 576e85e55af95da2ee0835c0e3c12ec7066cf48f0ae4b11eb0843829de350a2222ea35019cc26e0db4cd90cf9a11a77865ac2dd630498d2e8ed859c790c10807
SSDEEP 1536:WZZZZZZZZZZZZpXzzzzzzzzzzzzV9rXounV98hbHnAEMqqU+2bbbAV2/S2LNmHkD:wBounVyFHFMqqDL2/LgHkc2
TLSH
T168A36C0AB3E16293E1F25779FA747E66456E3D10BB249BDB09D348862D630F0293B713
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

upx ransomware backdoor gandcrab

Malware Config

Signatures

Family: Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
ransomware backdoor gandcrab

Detects Reflective DLL injection artifacts 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_ReflectiveLoader

Detects ransomware indicator 1 IoCs

resource	yara_rule
sample	SUSP_RANSOMWARE_Indicator_Jul20

GandCrab payload 1 IoCs

resource	yara_rule
sample	family_gandcrab

Gandcrab Payload 1 IoCs

resource	yara_rule
sample	Gandcrab

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-22_144d4ba1d563ee96b9cc81b9b11956b6_coinminer_elex_gandcrab

File Explorer

2026-08-22_144d4ba1d563ee96b9cc81b9b11956b6_coinminer_elex_gandcrab

.exe 97KB

2026-08-22_144d4ba1d563ee96b9cc81b9b11956b6_coinminer_elex_gandcrab

SHA256 8ad43622627aa6f97f65d8563217ef3085f3dfb0fa1e248152eb7204bee3fe0f
MD5 144d4ba1d563ee96b9cc81b9b11956b6
SHA1 4dfc70359907fad1cac899d30712287dc9df5b17
SHA512 576e85e55af95da2ee0835c0e3c12ec7066cf48f0ae4b11eb0843829de350a2222ea35019cc26e0db4cd90cf9a11a77865ac2dd630498d2e8ed859c790c10807
SSDEEP 1536:WZZZZZZZZZZZZpXzzzzzzzzzzzzV9rXounV98hbHnAEMqqU+2bbbAV2/S2LNmHkD:wBounVyFHFMqqDL2/LgHkc2
TLSH
T168A36C0AB3E16293E1F25779FA747E66456E3D10BB249BDB09D348862D630F0293B713
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Detects Reflective DLL injection artifacts
Detects ransomware indicator
GandCrab payload
Gandcrab Payload
UPX dump on OEP (original entry point)
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

19440

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths