Ransom:Win32/Gandcrab.AW!bit removal tips

The Ransom:Win32/Gandcrab.AW!bit is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Ransom:Win32/Gandcrab.AW!bit virus can do?

The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid
CAPE detected the Gandcrab malware family

How to determine Ransom:Win32/Gandcrab.AW!bit?


File Info:
name: EFFB57ABCBE6D39B5092.mlw
path: /opt/CAPEv2/storage/binaries/91766a670c83a584b61e5d754870932f225f43004d4a933369adeca7ff674a55
crc32: 861EA912
md5: effb57abcbe6d39b50923fb98e353627
sha1: 04c09cb68f99232faac88fb21112d56f47d3d9e9
sha256: 91766a670c83a584b61e5d754870932f225f43004d4a933369adeca7ff674a55
sha512: 825cc67e58237e19b86fc017a439696db16f47b4ff8a7c389c30edbbeec59bc2fafe29651ca6a1f548ddab3be0f5d850af4235f093b1aec661ebacd7a08d869e
ssdeep: 1536:bkSr4jdIOJqsRcYeltK5VjGiqm79F23t/svB0AqOAaZhCTo8ZksWjcdipDaIxLnb:bLrXA1WtojjTK9sqD68xipDaIxAc0N0
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1E4F35A12F6E44233D5B32630D4F4652646EE7E32C8369ADBD3D8174E1D294C29E29FA3
sha3_384: e8aeec79233ae66fbcf7c354d573812ef27b023ac12a31794baa00ae0ff20162e5d8566fb38be4e5a1d78328f26f317f
ep_bytes: 558bece8000000003e83042411750574
timestamp: 2018-10-26 08:47:08

Version Info:
0: [No Data]

Ransom:Win32/Gandcrab.AW!bit also known as:

Bkav	W32.AIDetectMalware
Elastic	malicious (high confidence)
MicroWorld-eScan	Generic.Ransom.GandCrab4.1BAAB108
FireEye	Generic.mg.effb57abcbe6d39b
Skyhigh	BehavesLike.Win32.Generic.cm
ALYac	Generic.Ransom.GandCrab4.1BAAB108
Cylance	unsafe
VIPRE	Generic.Ransom.GandCrab4.1BAAB108
Sangfor	Ransom.Win32.Gandcrab_10.se
K7AntiVirus	Ransomware ( 0053d33d1 )
K7GW	Ransomware ( 0053d33d1 )
Cybereason	malicious.68f992
Arcabit	Generic.Ransom.GandCrab4.1BAAB108
BitDefenderTheta	Gen:NN.ZexaF.36792.kyW@aymu7Hdi
VirIT	Trojan.Win32.Genus.LSJ
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Filecoder.GandCrab.D
Cynet	Malicious (score: 100)
APEX	Malicious
ClamAV	Win.Ransomware.Gandcrab-9764464-0
Kaspersky	Trojan-Ransom.Win32.GandCrypt.fbd
BitDefender	Generic.Ransom.GandCrab4.1BAAB108
Avast	RansomX-gen [Ransom]
Tencent	Trojan-Ransom.Win32.Gandcrab.16000557
Sophos	Troj/Patched-BY
TrendMicro	Ransom.Win32.GANDCRAB.SMK
Emsisoft	Generic.Ransom.GandCrab4.1BAAB108 (B)
Ikarus	Trojan-Ransom.GandCrab
Antiy-AVL	Trojan[Ransom]/Win32.GandCrypt.a
Kingsoft	malware.kb.a.1000
Xcitium	TrojWare.Win32.Gandcrab.AA@7w10qu
Microsoft	Ransom:Win32/Gandcrab.AW!bit
ZoneAlarm	Trojan-Ransom.Win32.GandCrypt.fbd
GData	Win32.Trojan.Agent.TQ7G26
Google	Detected
AhnLab-V3	Trojan/Win32.RL_Gandcrab.R264301
McAfee	Artemis!EFFB57ABCBE6
MAX	malware (ai score=87)
Malwarebytes	Generic.Malware.AI.DDS
TrendMicro-HouseCall	Ransom.Win32.GANDCRAB.SMK
Rising	Ransom.GandCrab!1.B42B (CLASSIC)
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/GandCrab.D!tr
AVG	RansomX-gen [Ransom]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (W)

How to remove Ransom:Win32/Gandcrab.AW!bit?

Ransom:Win32/Gandcrab.AW!bit removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X