File name:

GandCrab Binary

Full analysis: https://app.any.run/tasks/15c033af-99e2-4f79-b497-114c8f621b53
Verdict: Malicious activity
Threats:

GandCrab is probably one of the most famous Ransomware. A Ransomware is a malware that asks the victim to pay money in order to restore access to encrypted files. If the user does not cooperate the files are forever lost.

Malware Trends Tracker     >>>
Analysis date: January 23, 2019, 02:09:09
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ransomware
gandcrab
trojan
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

ACD62C0620F91F1C9BA8DF9871E1D588

SHA1:

9079BD76ABB862B8851CDD36A56763D5AC3E4A75

SHA256:

ABF3FDB17799F468E850D823F845647738B6674451383156473F1742FFBD61EC

SSDEEP:

3072:3T0i4GjnC8TWewrm4yWgCM8BbDer3QbPWIiXrqfrhKFIc47eWN3K+Hq3j+ySN:Qi4G7VJ4B3LnecbPEbqTPYjiySN

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • GandCrab keys found

      • GandCrab Binary.exe (PID: 3120)

    • Writes file to Word startup folder

      • GandCrab Binary.exe (PID: 3120)

    • Actions looks like stealing of personal data

      • GandCrab Binary.exe (PID: 3120)

    • Renames files like Ransomware

      • GandCrab Binary.exe (PID: 3120)

    • Dropped file may contain instructions of ransomware

      • GandCrab Binary.exe (PID: 3120)

    • Deletes shadow copies

      • GandCrab Binary.exe (PID: 3120)

    • Connects to CnC server

      • GandCrab Binary.exe (PID: 3120)

    • Changes settings of System certificates

      • GandCrab Binary.exe (PID: 3120)

  • SUSPICIOUS

    • Creates files in the program directory

      • GandCrab Binary.exe (PID: 3120)

    • Creates files like Ransomware instruction

      • GandCrab Binary.exe (PID: 3120)

    • Reads the cookies of Mozilla Firefox

      • GandCrab Binary.exe (PID: 3120)

    • Adds / modifies Windows certificates

      • GandCrab Binary.exe (PID: 3120)

    • Creates files in the user directory

      • GandCrab Binary.exe (PID: 3120)

  • INFO

    • Dropped object may contain TOR URL's

      • GandCrab Binary.exe (PID: 3120)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (41)
.exe | Win64 Executable (generic) (36.3)
.dll | Win32 Dynamic Link Library (generic) (8.6)
.exe | Win32 Executable (generic) (5.9)
.exe | Clipper DOS Executable (2.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2018:06:02 11:55:49+02:00
PEType: PE32
LinkerVersion: 10
CodeSize: 207360
InitializedDataSize: 207360
UninitializedDataSize: -
EntryPoint: 0x206c8
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 7.0.0.0
ProductVersionNumber: 3.0.0.0
FileFlagsMask: 0x004f
FileFlags: (none)
FileOS: Unknown (0x40534)
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Unknown (457A)
CharacterSet: Unknown (A56B)
FileVersion: 1.10.2.26
InternalName: gataja.exe
LegalCopyright: Copyright (C) 2018, caradasa
ProductVersion: 1.10.2.26

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 02-Jun-2018 09:55:49
Detected languages:
  • Croatian - Croatia
FileVersion: 1.10.2.26
InternalName: gataja.exe
LegalCopyright: Copyright (C) 2018, caradasa
ProductVersion: 1.10.2.26

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000E8

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 02-Jun-2018 09:55:49
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x000328E7
0x00032A00
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.89007
.data
0x00034000
0x00023CEC
0x00007600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0.483874
.mysec
0x00058000
0x0000100A
0x00000400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
0
.rsrc
0x0005A000
0x0000CF48
0x0000D000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
6.62571
.reloc
0x00067000
0x00001652
0x00001800
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
5.9407

Resources

Title
Entropy
Size
Codepage
Language
Type
1
3.35745
480
UNKNOWN
Croatian - Croatia
RT_VERSION
109
6.55581
47992
UNKNOWN
Croatian - Croatia
RT_BITMAP
234
1.7815
20
UNKNOWN
Croatian - Croatia
RT_GROUP_ICON

Imports

GDI32.dll
KERNEL32.dll
SHELL32.dll
USER32.dll

Exports

Title
Ordinal
Address
_MyFunc1@4
1
0x0001DDA4
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
34
Monitored processes
2
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #GANDCRAB gandcrab binary.exe wmic.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3120"C:\Users\admin\AppData\Local\Temp\GandCrab Binary.exe" C:\Users\admin\AppData\Local\Temp\GandCrab Binary.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\gandcrab binary.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
3280"C:\Windows\system32\wbem\wmic.exe" shadowcopy deleteC:\Windows\system32\wbem\wmic.exe—GandCrab Binary.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
WMI Commandline Utility
Exit code:
2147749908
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
Total events
150
Read events
98
Write events
45
Delete events
7

Modification events

(PID) Process:(3120) GandCrab Binary.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\ex_data\data
Operation:writeName:ext
Value:
2E00680071007200710070007500620072006A0076000000
(PID) Process:(3120) GandCrab Binary.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\keys_data\data
Operation:writeName:public
Value:
0602000000A400005253413100080000010001001DB289C1144F2995B378B3B02338CEE6F8D4FCC60C27216C0ABA76918F6694DB1CADB347E8A6379D50376A54A965C2F3B596C831886AA9E20AA7D454CA1393746BB91DF9260729A73AF82037D172BC5A44F03C9C8BD063E582592371809F5A6BDF7E06A0423CEC2F47D2F0DB787C742B2BDD0BC50CDB90242F17DD15269EA174932E2604E29C4CC1D9F23C7D9E18AD816A177EFBB0B82F307341E22F613DEB56FC7B3F0CF8F19DADD2135E6C810F2EB90C868CF17747B4281926A41ADA42FA245824CABE54BC3950EC72978B149BBCAB84CAD20D162463692820AF1B1919B5D4265D4DE7E67B0D3894E397B253704E520F944E88934C154AE571E493E22A6286
(PID) Process:(3120) GandCrab Binary.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\keys_data\data
Operation:writeName:private
Value:
94040000FF6ACBA203594A16F6CDCC27360E150C8CE43355709FD769F5E0F4DB604B81C335DC367E31BF5CEA22EC0FC63F53C44152708D988F1D2DA27BB6311376FA7850D6F6603A372E9F74BE803505E35598C2156BFDB78998626875234D558C88C473C5E3530AA18C6F65F07A13484BC53380C7F351D2DB4E53FC1E1558ED0552ACD4EEE912A5A11D6AD48ADD13CE90A48103530F0B8A877B1DB1C085F2EF2F09B0534B930B41C9A4C6C5DC6EE30BA873C3D7579DB01E94BF85C5114CC8E9277C4F1E46CA7FD14A43EE96484C4A40D4ED7CBD1BD31728511626390B98395728A4F57E650609F488C7ADCFCC98A0EBB9F0F77443B0A9023E7745CEA5FBAFECDA698F0D104E7BCD2521448C2F161D1114FA30248BE7BCC23D0DDA14EDF54B5643F1EF9B2618A1A540F2D32BD7060317B6A39A519CDC5DB3B88F7911474B8B5EE85875DB8D3DC51AA07F811FED0B78DA81186CB1801A88AE506660AA426AA89BD2AFCA7B8FC0030E9936C5CC7F7BB4CAF412B0F2D53DE702F75AE4B6F5946960F644DE5EFDA147498E585DD77172A88A9659FCDDEC35C2C6E8822857DB4F5139A9BE1100550F22B938823A6B315D81F9CBFF8B0338D465A072CB992F32737AECB282801C1D4C5E7ECB8B38D12AF5BD8D1C8EC1E549E2DA4CEBF26D7CFC76EA4D80A37FD6B5D7224261220C8DFDD6F34CF6DF5F1E02E6002A0073421D238D39C62061E16963E4EC22524A48B4411216658449F78A03CCFAC2320D99D95123945F8590218BC673DD2CF2B51BE398BE9A1CE0567B6164DF10503EE009D0CCA09EB9D1BB0B2A431E4E7A2DA22922AA25E8C23281B20DD4EBA692903D0669D09FC1E4C20D308BDCDB27C41182F0F690F55337F16E468E7A245FD593165D4F88BB28BF52B1308E49F325EE603B3619AF5C1F9A0019C9A9EC27072D171FA55B02F53694355231AD376E3A0FB9012CC9CE244A81D8CB4EFB62EDA7892E6BB69A9D0A292140F1C2C70615AEF15F3E020A7BCEABC2476E65486576A14FC4F2296740605C38C4D76E78ABEC8D5BFE12C970CA2C44187F9C2FE9F421B7F255B2F7EA4EE8F0967631A9AFFCF3E6F64FD0FC32FBE81D74ACE32DE018E89E47AE82D70E7607D40CB8D66C58527AED01B2E4022E88C23ED5B48E76E43E71D94D1F8457F11DE940A1E9509565B77FC7E763FB88DFF9B41FA143D46A6D5A50AB0FA3A6C1B6A3273B639E242DD29DF6D7EC61A78E3E8167B2E68D2DE95D3ED56A91CAE45641901A6E09EDF09CA3F8C1EE3B71DD2D5BAD853369B38A5E7964A6268DE6DB47F75498E70C61189A088C3336B66671E88865AF7C9AD77841EEDF188F808ADAFF4DE97BF3F4A1ED3F93F37847D12C6054ABEE1E6090B7DA8AAA01D1704767344BDC41622FCF7371586925C3422B07492592134BF649E4F99CCFB5F3BDC1E7B4E214D0071BC1B90F208535618C4526C3DC589867D4845600ADA5CF653C285689B97A8ADA8CB5340B58DC0E626D0C98D8D953E56E1116A699239C2ECD3ABAB43933D1E94175B9964086C40607384CCB16C07553955BD217F17372EE5C3949D1CC73B5A39F587670FF037A15A9B91119270D5859A524DD15EC86A56D0DE2F49B4ECBBE1B8F76EADF7C08F21CED610BA5E64DF071FE6725B0CECA41EF9C5AF88EAB2FBF2509FD81743B02C29D7B26AE76F52614AF36A727AD799F9D060904947E32207DE549B5F4304D388EB6AF61AA77C9FCDEDCB203A08B4A51B164E3F4FFA0FF2B946B601A6DDE2D744A7BA3C46E2AD26940568D09FD5784E56354FE76C05B9C3B5ECA92BC98F192F0BFA1FF15911B5317533EA74722AF7B2CF14F2CA028CF0D82D9894F74BA6848252E4C57C9D01B34AC19FC9835D476F0621DEADD5917994349BDB82488AC5791F699231092F9E88799841F893F7574B398361F8F36A6FE3C2817F165DEF7D575A2F94930AE738B31D94199D4F6C5B602EBBD9522F304E5B9F2AD324AF7BD13EAA054471CB7ECA2FCA556C2BB05895F3D6C7DF376ABBC86B699C4A06B05A103100957F3B14E4BB597CCE3D634052E217113CE041F294B963ECBD0BDBDE7D29409352ABD3CCDA3D20363969A921110A6684E153552644563A2DA13C4A4F7D4A1BE84235AF3CACA7D0B44E12BA5698BEDABB4F6EAB3DE5B8A1073F892C165848203C8E8DC5DECB37C97549921ACF3A2A486CB94DF7799B285A3B4D9D1D8DD4D0DB6F94026B28E8663B8178843CDD962DC959A833CBC33A4CEA2D6EB07C5D2B5F0F4FE37B27CE5DF1A9F038B0B4404108FC357C9F722B18B3A64961D69BFEF13094E2B5952A6D4D5DC8ACB3403D7C1498C6441C75BC2E2E1E7521522ABED5274E06F43A0D44EBAC624B09C3F09337C476A9D8B61E0871E67
(PID) Process:(3120) GandCrab Binary.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3120) GandCrab Binary.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(3120) GandCrab Binary.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\GandCrab Binary_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3120) GandCrab Binary.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\GandCrab Binary_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(3120) GandCrab Binary.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\GandCrab Binary_RASAPI32
Operation:writeName:FileTracingMask
Value:
4294901760
(PID) Process:(3120) GandCrab Binary.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\GandCrab Binary_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
4294901760
(PID) Process:(3120) GandCrab Binary.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\GandCrab Binary_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
Executable files
0
Suspicious files
281
Text files
210
Unknown types
8

Dropped files

PID
Process
Filename
Type
3120GandCrab Binary.exeC:\Users\admin\.oracle_jre_usage\90737d32e3abaa4.timestamp —
MD5:—
SHA256:—
3120GandCrab Binary.exeC:\Users\admin\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobData —
MD5:—
SHA256:—
3120GandCrab Binary.exeC:\Users\admin\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobSettings —
MD5:—
SHA256:—
3120GandCrab Binary.exeC:\Users\admin\AppData\Roaming\Adobe\Acrobat\DC\Security\addressbook.acrodata —
MD5:—
SHA256:—
3120GandCrab Binary.exeC:\Users\admin\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl —
MD5:—
SHA256:—
3120GandCrab Binary.exeC:\$Recycle.Bin\S-1-5-21-1302019708-1500728564-335382590-1000\HQRQPUBRJV-DECRYPT.txttext
MD5:—
SHA256:—
3120GandCrab Binary.exeC:\Users\admin\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl —
MD5:—
SHA256:—
3120GandCrab Binary.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\HQRQPUBRJV-DECRYPT.txttext
MD5:—
SHA256:—
3120GandCrab Binary.exeC:\Users\admin\HQRQPUBRJV-DECRYPT.txttext
MD5:—
SHA256:—
3120GandCrab Binary.exeC:\Users\admin\.oracle_jre_usage\HQRQPUBRJV-DECRYPT.txttext
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
32
TCP/UDP connections
57
DNS requests
26
Threats
18

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3120
GandCrab Binary.exe
GET
301
83.138.82.107:80
http://www.swisswellness.com/
DE
—
—
whitelisted
3120
GandCrab Binary.exe
GET
—
212.59.186.61:80
http://www.hotelweisshorn.com/
CH
—
—
malicious
3120
GandCrab Binary.exe
GET
301
83.166.138.7:80
http://www.whitepod.com/
CH
—
—
whitelisted
3120
GandCrab Binary.exe
GET
301
104.24.22.22:80
http://www.belvedere-locarno.com/
US
—
—
shared
3120
GandCrab Binary.exe
GET
301
80.244.187.247:80
http://www.hotelfarinet.com/
GB
—
—
malicious
3120
GandCrab Binary.exe
GET
—
217.26.53.37:80
http://www.hrk-ramoz.com/
CH
—
—
malicious
3120
GandCrab Binary.exe
GET
301
212.59.186.61:80
http://www.morcote-residenza.com/
CH
—
—
malicious
3120
GandCrab Binary.exe
GET
—
78.46.77.98:80
http://www.2mmotorsport.biz/
DE
—
—
suspicious
3120
GandCrab Binary.exe
GET
—
217.26.53.161:80
http://www.haargenau.biz/
CH
—
—
malicious
3120
GandCrab Binary.exe
POST
404
212.59.186.61:80
http://www.hotelweisshorn.com/content/tmp/kamoda.bmp
CH
html
220 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3120
GandCrab Binary.exe
78.46.77.98:80
www.2mmotorsport.biz
Hetzner Online GmbH
DE
suspicious
3120
GandCrab Binary.exe
78.46.77.98:443
www.2mmotorsport.biz
Hetzner Online GmbH
DE
suspicious
—
—
217.26.53.161:80
www.haargenau.biz
Hostpoint AG
CH
malicious
3120
GandCrab Binary.exe
217.26.53.161:80
www.haargenau.biz
Hostpoint AG
CH
malicious
3120
GandCrab Binary.exe
74.220.215.73:80
www.bizziniinfissi.com
Unified Layer
US
malicious
3120
GandCrab Binary.exe
136.243.13.215:80
www.holzbock.biz
Hetzner Online GmbH
DE
suspicious
3120
GandCrab Binary.exe
138.201.162.99:80
www.fliptray.biz
Hetzner Online GmbH
DE
malicious
3120
GandCrab Binary.exe
138.201.162.99:443
www.fliptray.biz
Hetzner Online GmbH
DE
malicious
3120
GandCrab Binary.exe
192.185.159.253:80
www.pizcam.com
CyrusOne LLC
US
malicious
3120
GandCrab Binary.exe
192.185.159.253:443
www.pizcam.com
CyrusOne LLC
US
malicious

DNS requests

Domain
IP
Reputation
www.2mmotorsport.biz
  • 78.46.77.98
unknown
www.haargenau.biz
  • 217.26.53.161
unknown
www.bizziniinfissi.com
  • 74.220.215.73
malicious
www.holzbock.biz
  • 136.243.13.215
unknown
www.fliptray.biz
  • 138.201.162.99
malicious
www.pizcam.com
  • 192.185.159.253
unknown
www.swisswellness.com
  • 83.138.82.107
whitelisted
www.hotelweisshorn.com
  • 212.59.186.61
unknown
www.whitepod.com
  • 83.166.138.7
whitelisted
www.hardrockhoteldavos.com
  • 69.16.175.42
  • 69.16.175.10
whitelisted

Threats

PID
Process
Class
Message
3120
GandCrab Binary.exe
A Network Trojan was detected
ET POLICY Data POST to an image file (gif)
3120
GandCrab Binary.exe
A Network Trojan was detected
ET TROJAN [eSentire] Win32/GandCrab v4/5 Ransomware CnC Activity
3120
GandCrab Binary.exe
A Network Trojan was detected
MALWARE [PTsecurity] Win32/GandCrab Ransomware CnC Activity
3120
GandCrab Binary.exe
A Network Trojan was detected
MALWARE [PTsecurity] GandCrab Ransomware HTTP
3120
GandCrab Binary.exe
A Network Trojan was detected
MALWARE [PTsecurity] Win32/GandCrab Ransomware CnC Activity
3120
GandCrab Binary.exe
A Network Trojan was detected
MALWARE [PTsecurity] GandCrab Ransomware HTTP
3120
GandCrab Binary.exe
A Network Trojan was detected
MALWARE [PTsecurity] Win32/GandCrab Ransomware CnC Activity
3120
GandCrab Binary.exe
A Network Trojan was detected
MALWARE [PTsecurity] GandCrab Ransomware HTTP
3120
GandCrab Binary.exe
A Network Trojan was detected
MALWARE [PTsecurity] Win32/GandCrab Ransomware CnC Activity
3120
GandCrab Binary.exe
A Network Trojan was detected
MALWARE [PTsecurity] GandCrab Ransomware HTTP
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
GandCrab Binary