gandcrab | 2024-06-16_2ede9c6e9355eb21545a0ff92de40715_gandcrab

Sharing

Target

2024-06-16_2ede9c6e9355eb21545a0ff92de40715_gandcrab
Size

97KB
MD5

2ede9c6e9355eb21545a0ff92de40715
SHA1

8c8ee33436839a9833ae55af013bbfc5ad3a5f5f
SHA256

8b28371c4d7017d66fe4ff9dd51963d6bf583fc133fa5a877568b22a9744c4f8
SHA512

f7b472b16bd62407549690a8bd01885d1af900b0c1e04b74aa887307cf6cbbddaa9e22ca8a6eb704feac3e3ba3fff5b5450af394a7724c5cc9398af70c432295
SSDEEP

1536:RZZZZZZZZZZZZpXzzzzzzzzzzzzV9rXounV98hbHnAlMqqU+2bbbAV2/S2LNmHkf:NBounVyFHkMqqDL2/LgHkctc

Score

10^/10

Detects Reflective DLL injection artifacts 1 IoCs

Processes:

resource yara_rule

sample INDICATOR_SUSPICIOUS_ReflectiveLoader
Detects ransomware indicator 1 IoCs

Processes:

resource yara_rule

sample SUSP_RANSOMWARE_Indicator_Jul20
GandCrab payload 1 IoCs

Processes:

resource yara_rule

sample family_gandcrab
Gandcrab Payload 1 IoCs

Processes:

resource yara_rule

sample Gandcrab
Gandcrab family
gandcrab
UPX dump on OEP (original entry point) 1 IoCs

Processes:

resource yara_rule

sample UPX
UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
upx

Processes:

resource yara_rule

sample upx
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.

Processes:

resource

2024-06-16_2ede9c6e9355eb21545a0ff92de40715_gandcrab

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_ReflectiveLoader

resource	yara_rule
sample	SUSP_RANSOMWARE_Indicator_Jul20

resource	yara_rule
sample	family_gandcrab

resource	yara_rule
sample	Gandcrab

resource	yara_rule
sample	UPX

resource	yara_rule
sample	upx

resource
2024-06-16_2ede9c6e9355eb21545a0ff92de40715_gandcrab