Generic.Ransom.GandCrab.6A21BEF3 removal tips

The Generic.Ransom.GandCrab.6A21BEF3 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Generic.Ransom.GandCrab.6A21BEF3 virus can do?

Sample contains Overlay data
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid
CAPE detected the Gandcrab malware family

How to determine Generic.Ransom.GandCrab.6A21BEF3?


File Info:
name: 7385530CF231FCE8D73C.mlw
path: /opt/CAPEv2/storage/binaries/fb1c177c6f10605e82a08d53117ac18153dee35619dd0b7b6fa0e8b09cf89f86
crc32: 70244959
md5: 7385530cf231fce8d73c20a4af97e52a
sha1: f62525126a415d1a1e2c7188cbd39677c36556e0
sha256: fb1c177c6f10605e82a08d53117ac18153dee35619dd0b7b6fa0e8b09cf89f86
sha512: b6014389cd5bb70be085b1a77e584cc9f5ba3e26aee2f0fbfb2897601232b1e794dcaebfb4a8d66e951ffea4ea779e149554fc0044143354aca74d01680f80a2
ssdeep: 1536:gZZZZZZZZZZZZpXzzzzzzzzzzzzV9rXouWVU8hbHnAsMqqU+2bbbAV2/S2Lkvd61:OBouWVzFHtMqqDL2/Lkvd
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1AB936A1E63E1B283E1F257B9FAB52E65456E3D103B299BDB89A3594528230F17837303
sha3_384: e2a4fc75ddf85de6808d97acbcdb276e86a0f17f4fe479364daeac56ae490191d705818e0e7ab57f8fd4a551a14e0c0b
ep_bytes: 5f5e5b8be55dc3cccccccccccccccccc
timestamp: 2018-02-20 17:28:57

Version Info:
0: [No Data]

Generic.Ransom.GandCrab.6A21BEF3 also known as:

Bkav	W32.AIDetectMalware
MicroWorld-eScan	Generic.Ransom.GandCrab.6A21BEF3
ClamAV	Win.Ransomware.Gandcrab-6667060-0
FireEye	Generic.mg.7385530cf231fce8
McAfee	GenericRXLP-XE!7385530CF231
Malwarebytes	Generic.Ransom.FileCryptor.DDS
VIPRE	Generic.Ransom.GandCrab.6A21BEF3
Sangfor	Ransom.Win32.Gandcrab_1.se
CrowdStrike	win/malicious_confidence_100% (W)
Cyren	W32/GandCrab.AR.gen!Eldorado
Elastic	malicious (high confidence)
APEX	Malicious
Cynet	Malicious (score: 100)
BitDefender	Generic.Ransom.GandCrab.6A21BEF3
Avast	Win32:Malware-gen
Tencent	Trojan-Ransom.Win32.Gandcrab.zk
Sophos	ML/PE-A
F-Secure	Trojan.TR/GandCrab.ceuhv
TrendMicro	Ransom.Win32.GANDCRAB.SM1
McAfee-GW-Edition	BehavesLike.Win32.Generic.nm
Trapmine	malicious.high.ml.score
Emsisoft	Generic.Ransom.GandCrab.6A21BEF3 (B)
Ikarus	Trojan-Ransom.GandCrab
GData	Win32.Trojan-Ransom.GandCrab.UR1Y74
Avira	TR/GandCrab.ceuhv
Antiy-AVL	Trojan[Ransom]/Win32.GandCrypt.c
Xcitium	TrojWare.Win32.Ransom.GandCrab.B@7kn2ff
Arcabit	Generic.Ransom.GandCrab.6A21BEF3
Microsoft	Ransom:Win32/GandCrab.AE
Google	Detected
ALYac	Generic.Ransom.GandCrab.6A21BEF3
MAX	malware (ai score=89)
Cylance	unsafe
Panda	Trj/CI.A
TrendMicro-HouseCall	Ransom.Win32.GANDCRAB.SM1
Rising	Ransom.GandCrab!1.B8D6 (CLASSIC)
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.121218.susgen
Fortinet	W32/GandCrab.B!tr.ransom
BitDefenderTheta	Gen:NN.ZexaF.36196.fCY@aC@2Qld
AVG	Win32:Malware-gen
Cybereason	malicious.cf231f
DeepInstinct	MALICIOUS

How to remove Generic.Ransom.GandCrab.6A21BEF3?

Generic.Ransom.GandCrab.6A21BEF3 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X