Sample details: d8dc6b439a241c5f19e67bf48ed14a8d --

Hashes
MD5: d8dc6b439a241c5f19e67bf48ed14a8d
SHA1: 7ac5533cf780dcffe0353d413fbabbc26cd723fa
SHA256: 16bab4a1d2fc20d764a41861949dd0c1c177e21fff31baa5cda46bb8c1398111
SSDEEP: 3072:G6iQiGfPhMqqDL2/phDMkcUrIwofej9Q7WWdE+FBaDmh8CohxBGER4JQtRR/olt0:GF2PqqqDL61uvdr
Details
File Type: PE32
Yara Hits
YRP/IsPE32 | YRP/IsDLL | YRP/IsWindowsGUI | YRP/HasRichSignature | YRP/maldoc_find_kernel32_base_method_1 | YRP/domain | YRP/contentis_base64 | YRP/Antivirus | YRP/VM_Generic_Detection | YRP/Dropper_Strings | YRP/Misc_Suspicious_Strings | YRP/network_http | YRP/win_mutex | YRP/win_registry | YRP/win_files_operation | YRP/Crypt32_CryptBinaryToString_API | YRP/Str_Win32_Wininet_Library | YRP/Str_Win32_Internet_API | YRP/Str_Win32_Http_API | FlorianRoth/ReflectiveLoader |
Strings
		!This program cannot be run in DOS mode.
.rdata
@.data
@.rsrc
@.reloc
SVWj@h
<}tK<=tBF
<}t)F<=t
HthHuo
<}tcG<=t
SVWj@h
SVWj@h
D$$PQh
D$$PWh
D$$PWh
SVWj@h
SVWj@h
QSVWj@h
0SWj@h
L&&jl66Z~??A
Oh44\Q
sb11S*
uB!!c 
D""fT**~;
;d22Vt::N
J%%o\..r8
gg}V++
jL&&Zl66A~??
Sb11?*
tX,,.4
RRMv;;a
MMUf33
PPDx<<
cB!!0 
~~Gz==
fD""~T**
Vd22Nt::
xxoJ%%r\..$8
ppB|>>
aa_j55
UUxP((z
&jL&6Zl6?A~?
~=Gz=d
"fD"*~T*
2Vd2:Nt:
x%oJ%.r\.
a5_j5W
=&&jL66Zl??A~
g99KrJJ
==Gzdd
""fD**~T
22Vd::Nt
$$lH\\
77Ynmm
%%oJ..r\
55_jWW
[T:$6.
[.:$6g
j_FbT~
h4,8$@_
2\tHlWB
PQAeS~
~4[C)v
8$4,6-9'$6.:*?#1pHhX~AeSlZrNbS
EHl\tFeQ
T~FbZwKi
,8$4'6-9:$6.1*?#XpHhS~AeNlZrEbS
FeQbT~FiZwK
4,8$9'6-.:$6#1*?hXpHeS~ArNlZ
EbS\tHlQ
FeFbT~KiZw
$4,8-9'66.:$?#1*HhXpAeS~ZrNlS
Ebl\tHeQ
F~FbTwKiZ
pub_key
DELETE}
{DELETE}
advapi32.dll
CheckTokenMembership
Address:
fabian wosar <3
Can't find server
aeriedjD#shasj
*******************
RtlComputeCrc32
GandCrabGandCrabnomoreransom.coinomoreransom.bit
encryption.dll
_ReflectiveLoader@0
ExitProcess
lstrlenA
HeapAlloc
HeapFree
GetProcessHeap
GetProcAddress
VirtualAlloc
GetModuleHandleA
lstrcpyA
GetEnvironmentVariableW
GetFileSize
MapViewOfFile
UnmapViewOfFile
GetModuleHandleW
WriteFile
GetModuleFileNameW
CreateFileW
ExitThread
lstrlenW
GetTempPathW
CreateFileMappingW
lstrcatW
CloseHandle
CreateThread
VirtualFree
lstrcmpiW
lstrcmpiA
SetFilePointer
GetFileAttributesW
ReadFile
GetLastError
MoveFileW
lstrcpyW
SetFileAttributesW
CreateMutexW
GetDriveTypeW
VerSetConditionMask
WaitForSingleObject
GetTickCount
InitializeCriticalSection
OpenProcess
GetSystemDirectoryW
TerminateThread
TerminateProcess
VerifyVersionInfoW
WaitForMultipleObjects
DeleteCriticalSection
ExpandEnvironmentStringsW
CreateProcessW
SetHandleInformation
lstrcatA
MultiByteToWideChar
CreatePipe
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
LeaveCriticalSection
EnterCriticalSection
FindFirstFileW
lstrcmpW
FindClose
FindNextFileW
GetNativeSystemInfo
GetComputerNameW
GetDiskFreeSpaceW
GetWindowsDirectoryW
GetVolumeInformationW
LoadLibraryA
KERNEL32.dll
DispatchMessageW
DefWindowProcW
UpdateWindow
SendMessageW
CreateWindowExW
ShowWindow
SetWindowLongW
LoadIconW
RegisterClassExW
TranslateMessage
wsprintfW
BeginPaint
LoadCursorW
GetMessageW
DestroyWindow
EndPaint
GetForegroundWindow
USER32.dll
TextOutW
GDI32.dll
RegCloseKey
RegCreateKeyExW
RegSetValueExW
AllocateAndInitializeSid
FreeSid
CryptExportKey
CryptAcquireContextW
CryptGetKeyParam
CryptReleaseContext
CryptImportKey
CryptEncrypt
CryptGenKey
CryptDestroyKey
GetUserNameW
RegQueryValueExW
RegOpenKeyExW
ADVAPI32.dll
ShellExecuteExW
ShellExecuteW
SHGetSpecialFolderPathW
SHELL32.dll
CryptStringToBinaryA
CryptBinaryToStringA
CRYPT32.dll
InternetOpenW
InternetReadFile
InternetConnectW
HttpSendRequestW
HttpAddRequestHeadersW
HttpOpenRequestW
InternetCloseHandle
WININET.dll
GetDeviceDriverBaseNameW
EnumDeviceDrivers
PSAPI.DLL
IsProcessorFeaturePresent
<?xml version='1.0' encoding='UTF-8' standalone='yes'?>
<assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>
  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
    <security>
      <requestedPrivileges>
        <requestedExecutionLevel level='asInvoker' uiAccess='false' />
      </requestedPrivileges>
    </security>
  </trustInfo>
</assembly>
1#1-171A1i1s1}1
2:2D2N2X2b2l2v2
3)333=3G3^3h3r3|3
4/494C4M4W4g4q4{4
5(585B5L5V5~5
6'6O6Y6c6m6w6
6 7*747>7H7R7\7s7}7
8#8-8D8N8X8b8l8|8
9)939=9M9W9a9k9
:(:2:<:d:n:x:
;5;?;I;S;];g;q;
='=1=;=E=m=w=
>?>I>S>]>g>q>{>
?%?/?9?C?M?e?o?y?
070A0K0U0_0o0y0
1'111A1K1U1_1
2'212Y2c2m2w2
3+353?3I3S3]3g3
4%4/494Q4[4e4o4y4
5#5-575A5K5[5e5o5y5
6-676A6K6s6}6
7E7O7Y7c7m7w7
7N8k8{8
<0<7<I<Z<b<
>0>U>[>j>w>
1S2]2d2u2
6(6Z6e6m6
8-989p9x9
:#:1:8:H:N:
=-=B=H=
>'>L>j>
0"0)030:0D0Q0k0
151A1I1Q1V1
6W6_6g6o6w6
7*757@7K7V7a7l7w7
8&8-878L8e8
9%:;:X:d:u:{:
;!;d;n;
;	<*</<
=Z=`=z=
?-?2?8?B?\?m?
0U0c0s0
1$1+181=1E1M1t1
2P2d2|2
373V3l3
4^4c4t4
6W6r6|6
:-:B:G:Q:^:s:x:
2!212=2i2
5,5T5]5z5
7-797E7Q7]7i7u7
7m8u8|8
8T9Y9f9t9z9
:<:Q:Z:j:p:
;!;.;?;P;Y;`;g;z;
<+<8<T<
>)>T>d>u>
?2?@?T?b?v?
0!0A0[0e0|0
1#191D1c1n1
2"343O3X3k3t3
4/4B4K4V4_4h4
5&595B5V5[5j5
7.73797@7P7
:#:*:1:8:?:F:M:h:~:
;@;J;h;
2)272r2
303>3R3`3
3:4A4Q4^4
5F5M5\5f5l5
6#6)6}6
6R7Y7i7v7
7'8.8>8K8
<5<<<@<D<H<L<P<T<X<
=%=@=G=L=P=T=u=
=>>D>H>L>P>
U0c0z0
1"1*1D1c1x1
4			P2
2-I	}#H
I	Xc	c	
XXa			
VirtualAllocEx
CreateRemoteThread
user32
SetCursorPos
sfc_os
SfcIsFileProtected
shlwapi
PathAppendA
C:\Documents and Settings\User\Desktop\agente\gandcrab.exe
nstaller\{A92EA95D-8603-4C3D-A3F1-E561CCFDE269}\_E0CA5A06C047789A9384B4.exe
explorer.exe
FService.exe
gandcrab.exe
789A9384B4.exe
E0CA5~1.EXE
agente
amp.txt
sshconnection
8-1003
4ccf-a09a-d29a25b6060a
e2b16).cab
ECENT~1
x\;US$
`f!TPg