gandcrab | 9932e5949fdc062b3c12769a6e5236e4f5caa40f0c966b879f5a306f0670ee52

Sharing

Target

9932e5949fdc062b3c12769a6e5236e4f5caa40f0c966b879f5a306f0670ee52
Size

109KB
MD5

d3537fec0b0ca4e6ae6f91b85b15c1d5
SHA1

ade90a54d16ccca3c8d2c4c25a2ede4786c7c368
SHA256

9932e5949fdc062b3c12769a6e5236e4f5caa40f0c966b879f5a306f0670ee52
SHA512

1298d94ca3c2671d43fdfcae62aa0886f43a3c9908ec0dc2ab64989f9f66aeab93b33d06060c2619081c676afd4f6980c70322a5a93cb1f9dea396e0b9fb5126
SSDEEP

3072:HMSjOnrmBIMqqDL2/mr3IdE8we0Avu5r++ygLIaaypQ8CrS6C:HXjOnr6jqqDL6aprYS6C

Score

10^/10

Family

gandcrab

http://gdcbghvjyqy7jclk.onion.top/

Detects ransomware indicator 1 IoCs

Processes:

resource yara_rule

sample SUSP_RANSOMWARE_Indicator_Jul20
GandCrab payload 1 IoCs

Processes:

resource yara_rule

sample family_gandcrab
Gandcrab Payload 1 IoCs

Processes:

resource yara_rule

sample Gandcrab
Gandcrab family
gandcrab
UPX dump on OEP (original entry point) 1 IoCs

Processes:

resource yara_rule

sample UPX
UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
upx

Processes:

resource yara_rule

sample upx
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.

Processes:

resource

9932e5949fdc062b3c12769a6e5236e4f5caa40f0c966b879f5a306f0670ee52

resource	yara_rule
sample	SUSP_RANSOMWARE_Indicator_Jul20

resource	yara_rule
sample	family_gandcrab

resource	yara_rule
sample	Gandcrab

resource	yara_rule
sample	UPX

resource	yara_rule
sample	upx

resource
9932e5949fdc062b3c12769a6e5236e4f5caa40f0c966b879f5a306f0670ee52