MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 64d341ecbc52f9d78080bf23559ec1778824979dd19498ee44032ec1d5224ff6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GandCrab


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 64d341ecbc52f9d78080bf23559ec1778824979dd19498ee44032ec1d5224ff6
SHA3-384 hash: 0d49a9f84494eb677fae06541cee10ab1e811a154f9fa4c64e4acd3b3468494e7a15a1525d7264c5f2e7f571b6850b24
SHA1 hash: f38e7d71f628521081b96e951886aaac71cbeace
MD5 hash: 2d351d67eab01124b7189c02cff7595f
humanhash: ten-triple-muppet-undress
File name:iec56w4ibovnb4wc.onion_Library__GandCrab__Gandcrab5.0.2.bin.malw
Download: download sample
Signature GandCrab
Create hunting rule
File size:172'032 bytes
First seen:2020-03-18 22:07:51 UTC
Last seen:2021-11-29 10:04:01 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 736a6a11a44089aba4b68375d4e88177 (6 x GandCrab)
ssdeep 3072:O8ZBa7+6dGwyRmSlZZ/cMIx2vjCgrQp0M2Kf8v9:O8UMR1cMIM00M2Kkv
Threatray 97 similar samples on MalwareBazaar
TLSH 28F3A03A62D08113C2ABF231D4E439254CD9BF3DD4A9396693F8277E79140A39D1DF8A
Reporter ov3rflow1
Tags:Gandcrab malw

Intelligence

File Origin
# of uploads :
2
# of downloads :
752
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Ransomware.Gandcrab-6667060-0
Create hunting rule

Win.Malware.Razy-6829823-0
Create hunting rule

MiscreantPunch.SingleXOR.EXE.24.UNOFFICIAL
Create hunting rule

Result
Malware family:
gandcrab
Create hunting rule
Score:
  10/10
Tags:
Ransomware
Link:
https://dragonfly.certego.net/analysis/85/overview
Behaviour
Gandcrab2
DumpingComputerRegistry
CheckHostName
CheckDiskSpace
SystemUptime
EnumerateProcesses
LanguageCheck
CheckComputerName
CallCrc32
ComputerProcessor
ComputerOsVersion
EvasionGetTickCount
CheckMutex
CheckCmdLine
Gathering data
Threat name:
Win32.Trojan.Gandcrab
Create hunting rule
Status:
Malicious
First seen:
2018-09-30 04:37:12 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
29 of 29 (100.00%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
098aad386b0f549cefddf2001dba9f31f40d88a3618cd3a8d5589b4b0b467342
GandCrab
49b769536224f160b6087dc866edf6445531c6136ab76b9d5079ce622b043200
GandCrab
52f2b6380b492c175837418285cbefa51f1de3187d00c01383bb5f9ca4ebe7db
GandCrab
872bf2c276fe3242513c2ed1b254a5ab3c0dea273dde944c05b711697811753f
GandCrab
a45bd4059d804b586397f43ee95232378d519c6b8978d334e07f6047435fe926
GandCrab
a81d350afaf97cc038b3f20b46d4757150d7854df5e56780326f91bc7d4fd215
GandCrab
b715ce2fa69bc8384df1a4137b50bc30e05c0f3f557fe8608635744543b9976d
GandCrab
c69f89c00b8f77d605e233ed31485c744fc6bbe3860e447c7086cdf044bce888
GandCrab
ca755b8915cb1025b4b5748e12cd7d3cbdccbcf90fd5986c911b066043d6d136
GandCrab
ed272a73e61d3ddc0f6d70e54387bb7f07821ebbf91dfa6fde536c5c1dabfc2e
GandCrab
+ 87 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Ransomware
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/64d341ecbc52f9d78080bf23559ec1778824979dd19498ee44032ec1d5224ff6

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
  
URLhaus
https://urlhaus.abuse.ch/url/54894/
  
URLhaus
https://urlhaus.abuse.ch/url/57614/
  
URLhaus
https://urlhaus.abuse.ch/url/57567/
  
URLhaus
https://urlhaus.abuse.ch/url/57564/
  
URLhaus
https://urlhaus.abuse.ch/url/60665/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
Reviews
IDCapabilitiesEvidence
AUTH_APIManipulates User AuthorizationADVAPI32.dll::GetSidSubAuthorityCount
ADVAPI32.dll::GetSidSubAuthority
COM_BASE_APICan Download & Execute componentsole32.dll::CoCreateInstance
SECURITY_BASE_APIUses Security Base APIADVAPI32.dll::GetTokenInformation
SHELL_APIManipulates System ShellSHELL32.dll::ShellExecuteW
SHELL32.dll::ShellExecuteExW
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::OpenProcess
ADVAPI32.dll::OpenProcessToken
KERNEL32.dll::CloseHandle
WININET.dll::InternetCloseHandle
KERNEL32.dll::CreateThread
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::LoadLibraryA
KERNEL32.dll::LoadLibraryW
KERNEL32.dll::LoadLibraryExW
KERNEL32.dll::GetDriveTypeW
KERNEL32.dll::GetDriveTypeA
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::WriteConsoleW
KERNEL32.dll::SetStdHandle
KERNEL32.dll::GetConsoleMode
KERNEL32.dll::GetConsoleCP
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CreateFileW
KERNEL32.dll::MoveFileW
KERNEL32.dll::GetWindowsDirectoryW
KERNEL32.dll::GetSystemDirectoryW
KERNEL32.dll::FindFirstFileW
WIN_BASE_USER_APIRetrieves Account InformationKERNEL32.dll::GetComputerNameW
ADVAPI32.dll::GetUserNameW
WIN_CRYPT_APIUses Windows Crypt APIADVAPI32.dll::CryptAcquireContextW
ADVAPI32.dll::CryptEncrypt
ADVAPI32.dll::CryptExportKey
ADVAPI32.dll::CryptGenKey
ADVAPI32.dll::CryptImportKey
WIN_NETWORK_APISupports Windows NetworkingMPR.dll::WNetEnumResourceW
MPR.dll::WNetOpenEnumW
WIN_REG_APICan Manipulate Windows RegistryADVAPI32.dll::RegCreateKeyExW
ADVAPI32.dll::RegOpenKeyExW
ADVAPI32.dll::RegQueryValueExW
ADVAPI32.dll::RegSetValueExW
WIN_USER_APIPerforms GUI ActionsUSER32.dll::CreateWindowStationW

Comments