GandCrab Ransomware

GandCrab Ransomware Description

The GandCrab Ransomware is an encryption ransomware Trojan. The GandCrab Ransomware is typically delivered to victims through the use of corrupted spam email attachments, which may install the GandCrab Ransomware through the use of bad embedded scripts. The GandCrab Ransomware seems to be an independent threat, and not a part of a larger family of ransomware. Every day, new ransomware threats are emerging, and the GandCrab Ransomware is just one of the numerous new ransomware Trojans that are being released by the cybercrooks, which was first observed on January 27, 2018.

How to Recognize the GandCrab Ransomware's Presence on a Computer

The GandCrab Ransomware runs on the infected computer using the file name 'GandCrab.exe.' The GandCrab Ransomware uses the AES-256 encryption to make the victim's files inaccessible. Once the GandCrab Ransomware encrypts the files, they will no longer be recoverable without the decryption key, which these people keep in their possession. The GandCrab Ransomware takes the victim's files hostage until the victim agrees to pay a large ransom in exchange for the decryption key. The GandCrab Ransomware represents a serious threat, and computer users are advised to take preemptive measures against the GandCrab Ransomware and the numerous ransomware Trojans that exist today. The GandCrab Ransomware marks the files encrypted by the attack with the file extension '.GDCB,' which is added to the end of each affected files' name.

The GandCrab Ransomware's Ransom Demand

The GandCrab Ransomware will deliver a ransom note in the form of a text file named 'GDCB-DECRYPT.txt,' which is dropped on the infected computer's Documents Library and the infected computer's desktop. The text of the GandCrab Ransomware's ransom note reads:

'—= GANDCRAB =—
Attention!
All your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB
The only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.
The server with your key is in a closed network TOR. You can get there by the following ways:
1. Download Tor browser – h[tt]ps://www.torproject[.]org/
2. Install Tor browser
3. Open Tor Browser
4. Open link in tor browser: h[tt]ps://gdcbghvjyqy7jclk[.]onion/6361f798c4ba3647
5. Follow the instructions on this page
If Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:
1.h[tt]ps://gdcbghvjyqy7jclk.onion[.]top/6361f798c4ba3647
2. h[tt]ps://gdcbghvjyqy7jclk.onion[.]casa/6361f798c4ba3647
3. h[tt]ps://gdcbghvjyqy7jclk.onion[.]guide/6361f798c4ba3647
4. h[tt]ps://gdcbghvjyqy7jclk.onion[.]rip/6361f798c4ba3647
5. h[tt]ps://gdcbghvjyqy7jclk.onion[.]plus/6361f798c4ba3647
On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.
DANGEROUS!
Do not try to modify files or use your own private key – this will result in the loss of your data forever!'

When the victims of the attack attempt to connect to the domain associated with the GandCrab Ransomware, the following message and text will be displayed:

'Welcome!
WE ARE REGRET, BUT ALL YOUR FILES WAS ENCRYPTED!
AS FAR AS WE KNOW:
Country
OS
PC User
Pc Name
PC Group
PC Lang.
HDD
Date of encrypt
Amount of your files
Volume of your files
But don't worry, you can return all your files! We can help you!
Below you can choose one of your encrypted file from your PC and decrypt him, it is test decryptor for you.
But we can decrypt only 1 file for free.
ATTENTION! Don't try use third-party decryptor tools! Because this will destroy yourr files!
What do you need?
You need GandCrab Decryptor. This software will decrypt all your encrypted files and will delete GandCrab from your PC. For purchase you need crypto-currency DASH (1 DASH = 760.567$). How to buy this currency you can read it here.
How much money you need to pay? Below we are specified amount and our wallet for payment
Price: 1.5 DASH (1200 USD)'

The GandCrab Ransomware's ransom demand uses Dash, a cryptocurrency not unlike Bitcoin. PC security researchers are strongly advised to ignore the contents of the GandCrab Ransomware's ransom note.

Infected with GandCrab Ransomware? Scan Your PC

Download SpyHunter's Spyware Scanner
to Detect GandCrab Ransomware
* SpyHunter's scanner is only for malware detection. If SpyHunter detects malware on your PC, you will need to purchase SpyHunter's malware removal tool to remove the malware threats. Read more on SpyHunter. If you no longer wish to have SpyHunter installed on your computer, follow these steps to uninstall SpyHunter.

Security Doesn't Let You Download SpyHunter or Access the Internet?

Solutions: Your computer may have malware hiding in memory that prevents any program, including SpyHunter, from executing on your computer. Follow to download SpyHunter and gain access to the Internet:
  • Use an alternative browser. Malware may disable your browser. If you're using IE, for example, and having problems downloading SpyHunter, you should open Firefox, Chrome or Safari browser instead.
  • Use a removable media. Download SpyHunter on another clean computer, burn it to a USB flash drive, DVD/CD, or any preferred removable media, then install it on your infected computer and run SpyHunter's malware scanner.
  • Start Windows in Safe Mode. If you can not access your Window's desktop, reboot your computer in "Safe Mode with Networking" and install SpyHunter in Safe Mode.
  • IE Users: Disable proxy server for Internet Explorer to browse the web with Internet Explorer or update your anti-spyware program. Malware modifies your Windows settings to use a proxy server to prevent you from browsing the web with IE.
If you still can't install SpyHunter? View other possible causes of installation issues.

Technical Information

Infection Statistics

Our MalwareTracker shows malware activity across the world. Explore real-time data of GandCrab Ransomware outbreaks and other threats from global to local level.

File System Details

GandCrab Ransomware creates the following file(s):
# File Name Size MD5 Detection Count
1 CRAB-DECRYPT.txt 71
2 %TEMP%\WinNtBackend-[NUMBERS].tmp.exe 65
3 file.exe 235,520 6866d8d8bf8565d94e0e1479978cf1e5 24
4 %TEMP%\pidor.bmp 17

Related Posts

Site Disclaimer

Enigmasoftware.com is not associated, affiliated, sponsored or owned by the malware creators or distributors mentioned on this article. This article should NOT be mistaken or confused in being associated in any way with the promotion or endorsement of malware. Our intent is to provide information that will educate computer users on how to detect, and ultimately remove, malware from their PC with the help of SpyHunter and/or manual removal instructions provided on this article.

This article is provided "as is" and to be used for educational information purposes only. By following any instructions on this article, you agree to be bound by the disclaimer. We make no guarantees that this article will help you completely remove the malware threats on your PC. Spyware changes regularly; therefore, it is difficult to fully clean an infected machine through manual means.

Leave a Reply

Please DO NOT use this comment system for support or billing questions. For SpyHunter technical support requests, please contact our technical support team directly by opening a customer support ticket via your SpyHunter. For billing issues, please refer to our "Billing Questions or Problems?" page. For general inquiries (complaints, legal, press, marketing, copyright), visit our "Inquiries and Feedback" page.

IMPORTANT! To be able to proceed, you need to solve the following simple math.
Please leave these two fields as is:
What is 8 + 6 ?

(2 votes, average: 5.00 out of 5)
Loading...
User Rating:
By GoldSparrow in Ransomware
Share:
Threat Scorecard
?
The ESL Threat Scorecard is an assessment report that is given to every malware threat that has been collected and analyzed through our Malware Research Center. The ESL Threat Scorecard evaluates and ranks each threat by using several metrics such as trends, incidents and severity over time.

In addition to the effective scoring for each threat, we are able to interpret anonymous geographic data to list the top three countries infected with a particular threat. The data used for the ESL Threat Scorecard is updated daily and displayed based on trends for a 30-day period. The ESL Threat Scorecard is a useful tool for a wide array of computer users from end users seeking a solution to remove a particular threat or security experts pursuing analysis and research data on emerging threats.

Each of the fields listed on the ESL Threat Scorecard, containing a specific value, are as follows:

Ranking: The current ranking of a particular threat among all the other threats found on our malware research database.

Threat Level: The level of threat a particular PC threat could have on an infected computer. The threat level is based on a particular threat's behavior and other risk factors. We rate the threat level as low, medium or high. The different threat levels are discussed in the SpyHunter Risk Assessment Model.

Infected PCs: The number of confirmed and suspected cases of a particular threat detected on infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter's Spyware Scanner.

% Change: The daily percent change in the frequency of infected PCs of a specific threat. The formula for percent changes results from current trends of a specific threat. An increase in the rankings of a specific threat yields a recalculation of the percentage of its recent gain. When a specific threat's ranking decreases, the percentage rate reflects its recent decline. For a specific threat remaining unchanged, the percent change remains in its current state. The % Change data is calculated and displayed in three different date ranges, in the last 24 hours, 7 days and 30 days. Next to the percentage change is the trend movement a specific malware threat does, either upward or downward, in the rankings. Each level of movement is color coded: a green up-arrow (∧) indicates a rise, a red down-arrow (∨) indicates a decline, and a brown equal symbol (=) indicates no change or plateaued.

Top 3 Countries Infected: Lists the top three countries a particular threat has targeted the most over the past month. This data allows PC users to track the geographic distribution of a particular threat throughout the world.
Ranking: 1439
Threat Level: 10
Infected PCs: 1,962
% Change 30 Days:
430%
7 Days:
-24%
1 Day:
-2%
Top 3 Countries Infected: Brazil, Mexico, Philippines