Categories: Ransom

Ransom:Win32/GandCrab!pz (file analysis)

The Ransom:Win32/GandCrab!pz is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Ransom:Win32/GandCrab!pz virus can do?

Behavioural detection: Executable code extraction – unpacking
Uses Windows utilities for basic functionality
Authenticode signature is invalid
CAPE detected the Gandcrab malware family
Checks the CPU name from registry, possibly for anti-virtualization
Attempts to modify proxy settings
Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Ransom:Win32/GandCrab!pz?


File Info:
name: 0BBCAD920E5E850C44C8.mlwpath: /opt/CAPEv2/storage/binaries/9097fd96f783a0aa3c7670aa9d936956c6557a8e8ea3f0bd48f6f3e2bc806ceecrc32: 9423DA5Emd5: 0bbcad920e5e850c44c8352bc925979dsha1: dc20f4b0a058bfb9cf4fb9072946f57327ea3b2bsha256: 9097fd96f783a0aa3c7670aa9d936956c6557a8e8ea3f0bd48f6f3e2bc806ceesha512: e29bb7e7096fdb8e486f7a1977e7ed319abbdf4b6d29306ce1717aa2bdb4d4bf991ddfbfe20f35dd68ce25ff8cd789d5aa3abad56b94e01c9022e7e41aad6790ssdeep: 1536:RrsWDX9pwpQUMqqU+2bbbAV2/S2mr3IdE8mne0Avu5r++yy7CA7GcIaapavdv:RjDX9pwzMqqDL2/mr3IdE8we0Avu5r+gtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T116935B012AE18133E6E3FAB165B86E65543A3E145B2CBCD700EC1D3E1E269E24D35B5Fsha3_384: a3c98a83b2968e85c4eb74812c42ce124c5827b5ba302ad316e21e378f601b7a3d463ae6dff66b3ad409a573f43b80caep_bytes: 558bece8a8fdffff6a00ff1568911900timestamp: 2018-02-03 18:58:37
Version Info:
0: [No Data]

Ransom:Win32/GandCrab!pz also known as:

Bkav	W32.AIDetectMalware
MicroWorld-eScan	Generic.Ransom.GandCrab.3D674B8A
CAT-QuickHeal	Trojan.Mauvaise.SL1
Skyhigh	BehavesLike.Win32.Generic.mm
McAfee	Ransomware-GJP!0BBCAD920E5E
Malwarebytes	Generic.Malware.AI.DDS
Sangfor	Ransom.Win32.Gandcrab_1.se
K7AntiVirus	Ransomware ( 0053d33d1 )
K7GW	Ransomware ( 0053d33d1 )
Cybereason	malicious.0a058b
Arcabit	Generic.Ransom.GandCrab.3D674B8A
Symantec	Ransom.GandCrab!g4
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Filecoder.GandCrab.H
Cynet	Malicious (score: 100)
APEX	Malicious
ClamAV	Win.Ransomware.Gandcrab-6667060-0
Kaspersky	Trojan-Ransom.Win32.GandCrypt.jzw
BitDefender	Generic.Ransom.GandCrab.3D674B8A
NANO-Antivirus	Trojan.Win32.Filecoder.kgozwu
Avast	Win32:RansomX-gen [Ransom]
Tencent	Trojan-Ransom.Win32.GandCrab.16000553
Sophos	Troj/GandCrab-A
F-Secure	Trojan.TR/Crypt.XPACK.Gen3
VIPRE	Generic.Ransom.GandCrab.3D674B8A
TrendMicro	Ransom_GANDCRAB.SMALY-4
Emsisoft	Trojan.Agent (A)
Ikarus	Trojan-Ransom.GandCrab
Jiangmin	Trojan.GandCrypt.aij
Varist	W32/GandCrab.AR.gen!Eldorado
Avira	TR/Crypt.XPACK.Gen3
Antiy-AVL	Trojan[Ransom]/Win32.GandCrab
Kingsoft	malware.kb.a.1000
Xcitium	TrojWare.Win32.Ransom.GandCrab.B@7kn2ff
Microsoft	Ransom:Win32/GandCrab!pz
ZoneAlarm	Trojan-Ransom.Win32.GandCrypt.jzw
GData	Win32.Trojan-Ransom.GandCrab.D
Google	Detected
AhnLab-V3	Malware/Win32.Generic.C2425584
Acronis	suspicious
BitDefenderTheta	Gen:NN.ZexaF.36680.fyW@a4hMCKki
ALYac	Generic.Ransom.GandCrab.3D674B8A
VBA32	BScope.Trojan.Chapak
Cylance	unsafe
Panda	Trj/Genetic.gen
TrendMicro-HouseCall	Ransom_GANDCRAB.SMALY-4
Rising	Ransom.GandCrab!1.B8D6 (CLASSIC)
Yandex	Trojan.GenAsa!Tj3lAktP/7c
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/GandCrab.B!tr.ransom
AVG	Win32:RansomX-gen [Ransom]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (D)