Ransom:Win32/Gandcrab.AH!eml removal

The Ransom:Win32/Gandcrab.AH!eml is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Ransom:Win32/Gandcrab.AH!eml virus can do?

Unconventionial language used in binary resources: Portuguese (Brazilian)
Network activity detected but not expressed in API logs
Anomalous binary characteristics

How to determine Ransom:Win32/Gandcrab.AH!eml?


File Info:
crc32: 261A7BDD
md5: 56067ca42563b0b44721c2296ba81e3d
name: 56067CA42563B0B44721C2296BA81E3D.mlw
sha1: 68058122d0ee77aab7fd9241adcd98da7525acc7
sha256: 7d198d80cb86bdf1199a3f920b93c550b04c92db2b305fac85b5a7197610454f
sha512: 490626f45676f8be36aa7bccf08680136ec0c57e4ea15b6a15cb9192de1a4dfc5296e99305f9a005cf7c891f079915d542d0989974485f4ca59df2b590e97696
ssdeep: 6144:oEWuS9CAKX6/36uwAdH43g3VqZaEjT1bHUb2pPQ9fO0mb2/:oEU9Ww93SXpU3w0V/
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
InternalName: decova.exe
ProductVersion: 2.7.1.0
Translation: 0x0359 0x04b0

Ransom:Win32/Gandcrab.AH!eml also known as:

Bkav	W32.AIDetect.malware1
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.Brsecmon.1
FireEye	Generic.mg.56067ca42563b0b4
Qihoo-360	Win32/Ransom.GandCrab.HwoCfi8A
McAfee	Trojan-FQPW!56067CA42563
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
Sangfor	Trojan.Win32.Save.a
BitDefender	Trojan.Brsecmon.1
Cybereason	malicious.42563b
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:Trojan-gen
NANO-Antivirus	Trojan.Win32.Kryptik.fnbcwf
Rising	Malware.Heuristic!ET#97% (RDMK:cmRtazrvFEEeoHL7SswSEYjv1Yhz)
Ad-Aware	Trojan.Brsecmon.1
Emsisoft	Trojan.Brsecmon.1 (B)
Comodo	TrojWare.Win32.Occamy.PR@83izc3
DrWeb	Trojan.MulDrop13.5284
Zillya	Backdoor.Agent.Win32.71541
TrendMicro	Trojan.Win32.SODINOK.SM.hp
McAfee-GW-Edition	Trojan-FQPW!56067CA42563
Sophos	ML/PE-A
Jiangmin	Backdoor.Agent.eto
MAX	malware (ai score=83)
Antiy-AVL	Trojan[Backdoor]/Win32.Agent
Microsoft	Ransom:Win32/Gandcrab.AH!eml
Arcabit	Trojan.Brsecmon.1
GData	Trojan.Brsecmon.1
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.MalPe4.C4343915
BitDefenderTheta	Gen:NN.ZexaF.34590.My0@aO0pUCoG
ALYac	Trojan.Brsecmon.1
Malwarebytes	Trojan.MalPack.GS
TrendMicro-HouseCall	Trojan.Win32.SODINOK.SM.hp
SentinelOne	Static AI – Suspicious PE
Fortinet	W32/GenKryptik.CVPE!tr
AVG	Win32:Trojan-gen
CrowdStrike	win/malicious_confidence_90% (W)

How to remove Ransom:Win32/Gandcrab.AH!eml?

Ransom:Win32/Gandcrab.AH!eml removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X