Categories: RansomTrojan

Trojan-Ransom.Win32.GandCrypt.hbt removal instruction

The Trojan-Ransom.Win32.GandCrypt.hbt is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan-Ransom.Win32.GandCrypt.hbt virus can do?

At least one process apparently crashed during execution
Executable code extraction
Compression (or decompression)
Creates RWX memory
The binary likely contains encrypted or compressed data.
Network activity detected but not expressed in API logs
Checks the CPU name from registry, possibly for anti-virtualization

How to determine Trojan-Ransom.Win32.GandCrypt.hbt?


File Info:
crc32: 151849FFmd5: c0645cee077359f0e7d0a98a4b23b22dname: C0645CEE077359F0E7D0A98A4B23B22D.mlwsha1: 585634109631326d83079f87838340946e46b427sha256: 22b6a78f09163c1910526fe545b8a190c9bb00cf1b335397ac6ed53bf445ccd1sha512: 01beba01e595b353146411195e85fedd7626759c2cfb25a98cea6fdf6db7d8dd5689d73555423e2627ed05d73657246af2c3511e70e9b6185d2f89a090d92df4ssdeep: 6144:S4cTy/bmESuOcKAS0mT02Q+S4rKL6CUkRCC1xcUMJ:Dc4LSRcKAS0mTxaKKWCUkBFMJtype: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
LegalCopyright: SolarWinds xa9. All rights reserved.Assembly Version: 1.5.69.2InternalName: FrontierFileVersion: 1.5.69.2CompanyName: SolarWindsFileDescription: Intranet DecodingLegalTrademarks: SolarWinds xa9. All rights reserved.Comments: Intranet DecodingProductName: FrontierLanguages: EnglishProductVersion: 1.5.69.2PrivateBuild: 1.5.69.2OriginalFilename: Frontier.exeTranslation: 0x0409 0x04b0

Trojan-Ransom.Win32.GandCrypt.hbt also known as:

Bkav	W32.Common.23D8CC3E
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.31485101
FireEye	Generic.mg.c0645cee077359f0
CAT-QuickHeal	Trojan.Mauvaise.SL1
ALYac	Trojan.Ransom.GandCrab
Cylance	Unsafe
VIPRE	Win32.Malware!Drop
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 00536a1e1 )
BitDefender	Trojan.GenericKD.31485101
K7GW	Trojan ( 00536a1e1 )
Cybereason	malicious.e07735
BitDefenderTheta	Gen:NN.ZexaF.34590.su0@aCuK4cdi
Cyren	W32/Trojan.XHQF-9072
Symantec	Downloader
APEX	Malicious
Avast	Win32:Malware-gen
Kaspersky	Trojan-Ransom.Win32.GandCrypt.hbt
Alibaba	Ransom:Win32/Genasom.ali1000102
NANO-Antivirus	Trojan.Win32.Encoder.flyeno
AegisLab	Trojan.Win32.GandCrypt.trv8
Rising	Ransom.GandCrypt!8.F33E (KTSE)
Ad-Aware	Trojan.GenericKD.31485101
Sophos	Mal/Generic-S + Mal/Generic-L
Comodo	Malware@#23asq4dfvlb7e
F-Secure	Trojan.TR/Crypt.ZPACK.xdyib
DrWeb	Trojan.Encoder.26667
Zillya	Trojan.GandCrypt.Win32.1586
TrendMicro	Ransom.Win32.GANDCRAB.THOAOGAI
McAfee-GW-Edition	Generic.buk
Emsisoft	Trojan.GenericKD.31485101 (B)
Ikarus	Trojan-Ransom.GandCrab
GData	Win32.Trojan-Ransom.GandCrab.GWKS8X
Jiangmin	Trojan.GandCrypt.tz
Webroot	W32.Trojan.GenKD
Avira	TR/Crypt.ZPACK.xdyib
Antiy-AVL	Trojan[Ransom]/Win32.GandCrypt
Arcabit	Trojan.Generic.D1E06CAD
ZoneAlarm	Trojan-Ransom.Win32.GandCrypt.hbt
Microsoft	Trojan:Win32/CryptInject
Cynet	Malicious (score: 100)
AhnLab-V3	Win-Trojan/Gandcrab04.Exp
Acronis	suspicious
McAfee	Generic.buk
MAX	malware (ai score=100)
VBA32	BScope.Trojan.Yakes
Malwarebytes	MachineLearning/Anomalous.100%
Panda	Trj/WLT.E
Zoner	Trojan.Win32.75549
ESET-NOD32	Win32/Filecoder.GandCrab.D
TrendMicro-HouseCall	Ransom.Win32.GANDCRAB.THOAOGAI
Tencent	Win32.Trojan.Raas.Auto
Yandex	Trojan.GandCrypt!UhcGyliUiGg
SentinelOne	Static AI – Malicious PE
eGambit	Unsafe.AI_Score_99%
Fortinet	W32/GandCrab_V5_0_4!tr.ransom
MaxSecure	Trojan.Malware.74042388.susgen
AVG	Win32:Malware-gen
Paloalto	generic.ml
CrowdStrike	win/malicious_confidence_100% (W)
Qihoo-360	Win32/Ransom.GandCrab.HgIASOcA