Categories: Ransom

Ransom.GandCrab.1903 (B) removal

The Ransom.GandCrab.1903 (B) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Ransom.GandCrab.1903 (B) virus can do?

Executable code extraction
Creates RWX memory
A process attempted to delay the analysis task.
A process created a hidden window
Unconventionial language used in binary resources: Czech
Uses Windows utilities for basic functionality
Deletes its original binary from disk
Attempts to repeatedly call a single API many times in order to delay analysis time
Attempts to identify installed AV products by registry key
Anomalous binary characteristics

Related domains:

ym.recimlix.biz

How to determine Ransom.GandCrab.1903 (B)?


File Info:
crc32: 0EE08F3Fmd5: 5e2465c8086a61fe1f6a1732d852e838name: 5E2465C8086A61FE1F6A1732D852E838.mlwsha1: a236f503d1b2ad25458dd698ec075e7208817e54sha256: 9d381ad64c3bb8ada741599658be016ca15df0a47175c71b19e191fbb12a5b9asha512: e8b48627bae938bfbd210abe0ab887beba3e534b74b1eff7c83df6ff726fe5c853d9c1a19f188e21a8e0f12a14d8fe2b18c57b957052736c697427690ba37135ssdeep: 3072:B6PzlLFQC2mCeUpXM1QiLJ7gT5hvwV+pUtzKCZbQIYuuYWNfXP96wH6R:B6Pz+xM1DL1gTr43zNb1unf96wtype: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
InternalName: sgfnghmj.exeFileVersion: 8.4.3.12

Ransom.GandCrab.1903 (B) also known as:

Bkav	W32.AIDetect.malware1
K7AntiVirus	Trojan ( 0053d5971 )
Elastic	malicious (high confidence)
DrWeb	Trojan.MulDrop8.60786
McAfee	Packed-FKN!5E2465C8086A
Malwarebytes	Trojan.Agent
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (D)
Alibaba	Trojan:Win32/Bunitu.ali1000105
K7GW	Trojan ( 0053d5971 )
Cybereason	malicious.8086a6
Symantec	Packed.Generic.525
ESET-NOD32	a variant of Win32/Kryptik.GJRD
APEX	Malicious
Avast	Win32:MalwareX-gen [Trj]
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Gen:Variant.Ransom.GandCrab.1903
NANO-Antivirus	Trojan.Win32.Kryptik.fhswgn
MicroWorld-eScan	Gen:Variant.Ransom.GandCrab.1903
Tencent	Win32.Trojan.Generic.Swuu
Ad-Aware	Gen:Variant.Ransom.GandCrab.1903
Sophos	Mal/Generic-S + Mal/GandCrab-G
Comodo	Malware@#38dvo92oge2o7
BitDefenderTheta	AI:Packer.A63DAD0620
TrendMicro	Mal_HPGen-50
McAfee-GW-Edition	BehavesLike.Win32.Generic.dc
FireEye	Generic.mg.5e2465c8086a61fe
Emsisoft	Gen:Variant.Ransom.GandCrab.1903 (B)
SentinelOne	Static AI – Malicious PE
Jiangmin	Trojan.Generic.coeaw
Avira	HEUR/AGEN.1103322
eGambit	Unsafe.AI_Score_99%
Antiy-AVL	Trojan/Generic.ASMalwS.27C2B30
Microsoft	Ransom:Win32/GandCrab.AT!bit
AegisLab	Trojan.Win32.Generic.4!c
GData	Gen:Variant.Ransom.GandCrab.1903
AhnLab-V3	Win-Trojan/MalPe34.Suspicious.X2029
Acronis	suspicious
MAX	malware (ai score=100)
Panda	Trj/GdSda.A
TrendMicro-HouseCall	Mal_HPGen-50
Rising	Malware.Obscure/Heur!1.9E03 (CLOUD)
Yandex	Trojan.GenAsa!DJKV6anhAB4
Ikarus	Trojan-Downloader.Win32.Zurgop
MaxSecure	Ransomeware.CRAB.gen
Fortinet	W32/Kryptik.GKJF!tr
AVG	Win32:MalwareX-gen [Trj]
Paloalto	generic.ml