Ransom:Win32/GandCrab.AG removal guide

The Ransom:Win32/GandCrab.AG is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Ransom:Win32/GandCrab.AG virus can do?

• Executable code extraction
• Creates RWX memory
• A process attempted to delay the analysis task.
• Expresses interest in specific running processes
• Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
• Reads data out of its own binary image
• Drops a binary and executes it
• Unconventionial language used in binary resources: Spanish (Guatemala)
• Detects the presence of Wine emulator via function name
• Detects Sandboxie through the presence of a library
• Detects SunBelt Sandbox through the presence of a library
• Attempts to remove evidence of file being downloaded from the Internet
• Tries to unhook or modify Windows functions monitored by Cuckoo
• Network activity contains more than one unique useragent.
• Installs itself for autorun at Windows startup
• Creates a hidden or system file
• Operates on local firewall’s policies and settings
• Creates a copy of itself
• Anomalous binary characteristics

How to determine Ransom:Win32/GandCrab.AG?

File Info:
crc32: CA249BAC
md5: 57c73a6e6a7377191191bbaf673deb79
name: 57C73A6E6A7377191191BBAF673DEB79.mlw
sha1: 6ef15ea50f1c2b023bfc81520d897ee5d7164d4f
sha256: 167196e5a69385e8a98c128e3c1acda4763810f59c5a9485d064dbf35839f5a2
sha512: ba8c81cc1e8c091f32e9ed4be1f99c7aefa42dab86579da1e704d349ffba4c1c60e6b9f2e068dd69a647e39d9bac4a181eec9a3e351b1f9d09bdbf0fe013c6aa
ssdeep: 6144:ZaGUomaQAOixN5MJU8c8xUiBV+UdvrEFp7hK9Ye:ARSQiN5p8c+UiBjvrEH7K
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: Copyright (C) 2017, tvevabhuehb
FileVersion: 6.3.6.8
ProductVersion: 6.3.6.8
Translation: 0x0809 0x04b0

Ransom:Win32/GandCrab.AG also known as:

How to remove Ransom:Win32/GandCrab.AG?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.