{
	"id": "e2c5e6b6-3956-4e57-aaf7-578fd7870ee3",
	"created_at": "2026-04-06T00:13:19.549099Z",
	"updated_at": "2026-04-10T13:12:23.024812Z",
	"deleted_at": null,
	"sha1_hash": "97fd179732ad1d1705fa590333e86d8b932643ee",
	"title": "GreHack 2018: The Evolution Of GandCrab Ransomware",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 32615,
	"plain_text": "GreHack 2018: The Evolution Of GandCrab Ransomware\r\nArchived: 2026-04-05 12:49:06 UTC\r\nThe vast majority of ransomware infections in the past years have been results of ransomware being sold as an\r\neasy-to-use service, following the Ransomware-as-a-Service (RaaS) model. In 2018, the RaaS-space was\r\ndominated by a new malware family: GandCrab.\r\nVMRay Sr. Threat Researcher, Tamas Boczan tracked and analyzed the family from the earliest stages to the latest\r\nversion, observing differences between versions, like added features and rewritten functions. Besides the reverse-engineering of the payload, Tamas analyzed the various distribution methods: drive-by downloads via exploit kits\r\nand different Javascript and Word doc droppers attached to spam e-mails.\r\nIn this GreHack 2018 presentation, you will learn the technical details about the different methods used to\r\ndistribute GandCrab, interesting facts about the packer, and evolution of the payload.\r\nCovered in The Webinar\r\nAbout The Speakers\r\nExplore Valuable Cybersecurity Resources\r\nSource: http://www.vmray.com/cyber-security-blog/gandcrab-ransomware-evolution-analysis/\r\nhttp://www.vmray.com/cyber-security-blog/gandcrab-ransomware-evolution-analysis/\r\nPage 1 of 1",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA",
		"Malpedia"
	],
	"origins": [
		"web"
	],
	"references": [
		"http://www.vmray.com/cyber-security-blog/gandcrab-ransomware-evolution-analysis/"
	],
	"report_names": [
		"gandcrab-ransomware-evolution-analysis"
	],
	"threat_actors": [],
	"ts_created_at": 1775434399,
	"ts_updated_at": 1775826743,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/97fd179732ad1d1705fa590333e86d8b932643ee.pdf",
		"text": "https://archive.orkl.eu/97fd179732ad1d1705fa590333e86d8b932643ee.txt",
		"img": "https://archive.orkl.eu/97fd179732ad1d1705fa590333e86d8b932643ee.jpg"
	}
}