gandcrab | 2024-06-18_8c8d3d84ae7deb729e78dcf97cf4f42f_gandcrab

Sharing

Target

2024-06-18_8c8d3d84ae7deb729e78dcf97cf4f42f_gandcrab
Size

97KB
MD5

8c8d3d84ae7deb729e78dcf97cf4f42f
SHA1

d576da3637ea725fc626e12af390408b23b98c71
SHA256

ba0116cd4e979541584aadde12c54bc683013c5e931c5ca7d6ca5ec464882139
SHA512

ce491b41c45a310d2dc3227ca66144ff0256db4c9c9cdc5f82743e69627fd4e8aeb11a88a146e6cbf4a55b60c74effef19036011efb3c5df4e1bf88ee32e733c
SSDEEP

1536:oZZZZZZZZZZZZpXzzzzzzzzzzzzV9rXounV98hbHnAlMqqU+2bbbAV2/S2LNmHkf:mBounVyFHkMqqDL2/LgHkctc

Score

10^/10

Detects Reflective DLL injection artifacts 1 IoCs

Processes:

resource yara_rule

sample INDICATOR_SUSPICIOUS_ReflectiveLoader
Detects ransomware indicator 1 IoCs

Processes:

resource yara_rule

sample SUSP_RANSOMWARE_Indicator_Jul20
GandCrab payload 1 IoCs

Processes:

resource yara_rule

sample family_gandcrab
Gandcrab Payload 1 IoCs

Processes:

resource yara_rule

sample Gandcrab
Gandcrab family
gandcrab
UPX dump on OEP (original entry point) 1 IoCs

Processes:

resource yara_rule

sample UPX
UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
upx

Processes:

resource yara_rule

sample upx
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.

Processes:

resource

2024-06-18_8c8d3d84ae7deb729e78dcf97cf4f42f_gandcrab

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_ReflectiveLoader

resource	yara_rule
sample	SUSP_RANSOMWARE_Indicator_Jul20

resource	yara_rule
sample	family_gandcrab

resource	yara_rule
sample	Gandcrab

resource	yara_rule
sample	UPX

resource	yara_rule
sample	upx

resource
2024-06-18_8c8d3d84ae7deb729e78dcf97cf4f42f_gandcrab