Categories: Ransom

Ransom.GandCrab.1903 removal

The Ransom.GandCrab.1903 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Ransom.GandCrab.1903 virus can do?

Executable code extraction
Creates RWX memory
A process created a hidden window
Unconventionial language used in binary resources: Czech
Uses Windows utilities for basic functionality
Attempts to repeatedly call a single API many times in order to delay analysis time
Installs itself for autorun at Windows startup
Attempts to identify installed AV products by registry key
Anomalous binary characteristics

How to determine Ransom.GandCrab.1903?


File Info:
crc32: 64B9E376md5: 7aae7b40ed97c8054dc6b97b74b897dcname: 7AAE7B40ED97C8054DC6B97B74B897DC.mlwsha1: e7233f4f2c4f716fefd2945d642510d6876eb53csha256: 7d0093ba25a32b1619f23a865ed813c37cbebcbc566cf6336d2ec85e262c643fsha512: e0353bd4068849cc2cb35d3abdfd65055481e61b7edb6c58c401b7280ec00ca0c998775acf7136a30238432857cd43a96f54b6773f02d4aae85b4cd655980419ssdeep: 3072:86PzlWMGQC2mCeKpXQ46mDO7gaPvz5Qr+pUwdKIfz6D2tjBA6NyXP96w8R/:86PzggxQ41DQgaHzSEd7fz6Ajwf96wtype: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
InternalName: sgfnghmj.exeFileVersion: 8.4.3.12

Ransom.GandCrab.1903 also known as:

Bkav	W32.AIDetect.malware1
K7AntiVirus	Trojan ( 0053d5971 )
Elastic	malicious (high confidence)
DrWeb	Trojan.Siggen7.56435
Cynet	Malicious (score: 100)
ALYac	Gen:Variant.Ransom.GandCrab.1903
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_80% (D)
Alibaba	Trojan:Win32/Bunitu.ali1000105
K7GW	Trojan ( 0053d5971 )
Cybereason	malicious.0ed97c
Symantec	Packed.Generic.525
ESET-NOD32	a variant of Win32/Kryptik.GJRD
APEX	Malicious
Avast	FileRepMalware
Kaspersky	Trojan.Win32.Chapak.anoi
BitDefender	Gen:Variant.Ransom.GandCrab.1903
NANO-Antivirus	Trojan.Win32.Kryptik.fgphun
MicroWorld-eScan	Gen:Variant.Ransom.GandCrab.1903
Tencent	Win32.Trojan.Chapak.Akfu
Ad-Aware	Gen:Variant.Ransom.GandCrab.1903
Sophos	Mal/Generic-S + Mal/GandCrab-G
Comodo	Malware@#ewksp1cti9k1
BitDefenderTheta	Gen:NN.ZexaF.34608.nu0@ayv6sEaG
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	Mal_HPGen-50
McAfee-GW-Edition	BehavesLike.Win32.Generic.dh
FireEye	Generic.mg.7aae7b40ed97c805
Emsisoft	Gen:Variant.Ransom.GandCrab.1903 (B)
SentinelOne	Static AI – Suspicious PE
Avira	HEUR/AGEN.1103322
eGambit	Unsafe.AI_Score_99%
Microsoft	Ransom:Win32/GandCrab.AT!bit
AegisLab	Trojan.Win32.Chapak.4!c
GData	Gen:Variant.Ransom.GandCrab.1903
AhnLab-V3	Win-Trojan/MalPe34.Suspicious.X2029
Acronis	suspicious
McAfee	Packed-FKN!7AAE7B40ED97
MAX	malware (ai score=100)
VBA32	Trojan.Chapak
Malwarebytes	Trojan.Agent
Panda	Trj/GdSda.A
TrendMicro-HouseCall	Mal_HPGen-50
Rising	Malware.Obscure/Heur!1.9E03 (CLOUD)
Ikarus	Trojan-Downloader.Win32.Zurgop
MaxSecure	Ransomeware.CRAB.gen
Fortinet	W32/Kryptik.GKJF!tr
AVG	FileRepMalware
Paloalto	generic.ml
Qihoo-360	Win32/Trojan.333