███████╗██╗ ██╗██╗██╗ ███╗ ███╗██╗ ██╗████████╗███████╗██╗ ██╗ ██╔════╝██║ ██║██║██║ ████╗ ████║██║ ██║╚══██╔══╝██╔════╝╚██╗██╔╝ █████╗ ██║ ██║██║██║ ██╔████╔██║██║ ██║ ██║ █████╗ ╚███╔╝ ██╔══╝ ╚██╗ ██╔╝██║██║ ██║╚██╔╝██║██║ ██║ ██║ ██╔══╝ ██╔██╗ ███████╗ ╚████╔╝ ██║███████╗ ██║ ╚═╝ ██║╚██████╔╝ ██║ ███████╗██╔╝ ██╗ ╚══════╝ ╚═══╝ ╚═╝╚══════╝ ╚═╝ ╚═╝ ╚═════╝ ╚═╝ ╚══════╝╚═╝ ╚═╝

⚠

GandCrab

ransomware2 mutex signatures

[BASIC_INFORMATION]

FAMILY_NAME:

GandCrab

CATEGORY:

RANSOMWARE

DESCRIPTION:

GandCrab was a highly prolific Ransomware-as-a-Service (RaaS) that operated from early 2018 to mid-2019. It was distributed through various methods, including exploit kits and spam email campaigns, before its operators announced their retirement.

ALIASES:

gandcrab-ransomware

TAGS:

file_encryptionRaaSexploit_kitspam

[MUTEX_SIGNATURES](2)

[MUTEX_01]

Global\pc_group=<Pc_Group>&ransom_id=<Victim_id>

ANALYST: @adhikara13 DATE: 2024-08-01

REFERENCES:

https://www.acronis.com/en-sg/blog/posts/gandcrab/

[MUTEX_02]

AversSucksForever

ANALYST: @adhikara13 DATE: 2024-08-01

REFERENCES:

https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ransom.win32.gandcrab.tioiboch

[QUICK_ACTIONS]

[THREAT_INTELLIGENCE]

ATTRIBUTION:

⚠GandCrab

FIRST_OBSERVED:

2018

[SIGMA_RULE]

[STATISTICS]

MUTEX_COUNT:2

THREAT_ACTORS:1

ALIASES:1

TAGS:4

CATEGORY:RANSOMWARE

Malware profile loaded successfully