gandcrab | 2026-09-24_0eb6e743ba82b664b9686f383c9f8cbb_coinminer_elex_gandcrab

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-24_0eb6e743ba82b664b9686f383c9f8cbb_coinminer_elex_gandcrab
Size 97KB
Sample260924-e3a5haea45
SHA256 2c037261dffdd42785598c4d5fe327a08c7312191c5f9fb5f70218c4ceb01329
MD5 0eb6e743ba82b664b9686f383c9f8cbb
SHA1 2eda5c1c19a6b69bf8bc00a2d387c3265db8f029
SHA512 895fe5e9b1fd3ed12ea549d00ae38762ad1f988b08cd5204c18af60ea316358434d245ac805afd109342f666907dbb7386f59a111e3eb4f0dec3427fc99cf071
SSDEEP 1536:WZZZZZZZZZZZZpXzzzzzzzzzzzzV9rXounV98hbHnAEMqqU+2bbbAV2/S2LNmHkD:wBounVyFHFMqqDL2/LgHkc2
TLSH
T1DDA36B0AB3E16293E1F25779FA747E66456E3D10BB249BDB09D348862D630F0293B713
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

upx ransomware backdoor gandcrab

Malware Config

Signatures

Family: Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
ransomware backdoor gandcrab

Detects Reflective DLL injection artifacts 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_ReflectiveLoader

Detects ransomware indicator 1 IoCs

resource	yara_rule
sample	SUSP_RANSOMWARE_Indicator_Jul20

GandCrab payload 1 IoCs

resource	yara_rule
sample	family_gandcrab

Gandcrab Payload 1 IoCs

resource	yara_rule
sample	Gandcrab

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-24_0eb6e743ba82b664b9686f383c9f8cbb_coinminer_elex_gandcrab

File Explorer

2026-09-24_0eb6e743ba82b664b9686f383c9f8cbb_coinminer_elex_gandcrab

.exe 97KB

2026-09-24_0eb6e743ba82b664b9686f383c9f8cbb_coinminer_elex_gandcrab

SHA256 2c037261dffdd42785598c4d5fe327a08c7312191c5f9fb5f70218c4ceb01329
MD5 0eb6e743ba82b664b9686f383c9f8cbb
SHA1 2eda5c1c19a6b69bf8bc00a2d387c3265db8f029
SHA512 895fe5e9b1fd3ed12ea549d00ae38762ad1f988b08cd5204c18af60ea316358434d245ac805afd109342f666907dbb7386f59a111e3eb4f0dec3427fc99cf071
SSDEEP 1536:WZZZZZZZZZZZZpXzzzzzzzzzzzzV9rXounV98hbHnAEMqqU+2bbbAV2/S2LNmHkD:wBounVyFHFMqqDL2/LgHkc2
TLSH
T1DDA36B0AB3E16293E1F25779FA747E66456E3D10BB249BDB09D348862D630F0293B713
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Detects Reflective DLL injection artifacts
Detects ransomware indicator
GandCrab payload
Gandcrab Payload
UPX dump on OEP (original entry point)
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

19440

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths