Ransom.GandCrab

Short bio

Ransom.GandCrab is Malwarebytes’ detection name for a family of ransomware that encrypts important files and asks for a ransom to decrypt them. There are several versions of Ransom.GandCrab as the threat actors keep working on it. They all target Windows systems.

Symptoms

The first thing users of affected systems notice is usually the ransom note when the encryption has altready finished.

Type and source of infection

Ransom.GandCrab scans the infected system and any network shares for files to encrypt. You can recognize the version of GandCrab by looking at the extensions the encrypted files have:

• Version 1 gives the .gdcb extension
• Version 2 and 3 give the .crab extension
• Version 4 gives the .krab extension
• Version 5 gives a randomized 5 letter extension

Ransom.GandCrab is spread in many different ways:

• malspam
• exploit kits
• social engineering
• fake cracked software sites

Aftermath

For some versions of Ransom.GandCrab there are free decryption tools. You can check the NoMoreRansom! for which ones they are currently available.

Protection

Malwarebytes protects users from Ransom.GandCrab by using real-time protection.

and Malwarebytes protects users from Ransom.GandCrab by using Anti-Ransomware technology.

Business remediation

Malwarebytes can detect and remove Ransom.GandCrab on business machines without further user interaction.
To remove Ransom.GandCrab using Malwarebytes business products, follow the instructions below.

How to remove Ransom.GandCrab with Malwarebytes Endpoint Protection

1. 1. Go to the Malwarebytes Cloud console.
   2. To allow you to invoke a scan while the machine is off the network, go to Settings > Policies > your policy > General.
   3. Under Endpoint Interface Options, turn ON:
      1. Show Malwarebytes icon in notification area
      2. Allow users to run a Threat Scan (all threats will be quarantined automatically)

      

If you have infected machines that are not registered endpoints in Malwarebytes Endpoint Protection, you can remove {detection name} with our Breach Remediation tool (MBBR).

1. 1. 1. Log into your My Account page and copy your license key. The key is needed to activate MBBR tool.
      2. Open your Cloud console.
      3. From a clean and safe machine, go to Endpoints > Add > Malwarebytes Breach Remediation. This will download the MBBR zip package.
      4. Unzip the package.
      5. Access a Windows command line prompt and issue the following commands:
         mbbr register –key:<prodkey>
         mbbr update
         Note: You must substitute your license key for <prodkey>.
      6. Copy the MBBR folder to a flash drive.
      7. From an infected, offline machine, copy the MBBR folder from the flash drive.
      8. Start a scan using the following command:
         mbbr scan –full –ark –remove –noreboot
      9. Refer to the Malwarebytes Breach Remediation Windows Administrator Guide for all supported scanning commands.

How to remove Ransom.GandCrab with Malwarebytes Endpoint Security

You can use Malwarebytes Anti-Malware v1.80, which is included in your Malwarebytes Endpoint Security deployment to scan and remove Ransom.GandCrab.

Option 1

1. 1. 1. Remove the infected endpoint from the network.
      2. On the infected machine, right click the system tray icon and click on Start Scanner.
         
      3. Select Perform full scan.
         
      4. Click on Scan button.

Option 2

1. 1. 1. Open CMD
      2. CD to C:\Program Files (x86)\Malwarebytes’ Anti-Malware
      3. Run mbamapi /scan –full –remove -reboot

Use the “rollback files encrypted by ransomware” option in Malwarebytes Endpoint Protection and Response if the infection was caught after it had encrypted some files. This may be the case if the infection was not caught by the Real-Time-Protection module, but by the behavioral based Anti-Ransomware Technology.

Home remediation

Malwarebytes can detect and remove Ransom.GandCrab without further user interaction.

1. Please download Malwarebytes to your desktop.
2. Double-click mb3-setup-consumer-{version}.exe and follow the prompts to install the program.
3. Then click Finish.
4. Once the program has fully updated, select Scan Now on the Dashboard. Or select the Threat Scan from the Scan menu.
5. If another update of the definitions is available, it will be implemented before the rest of the scanning procedure.
6. When the scan is complete, make sure that all Threats are selected, and click Remove Selected.
7. Restart your computer when prompted to do so.

Take note, however, that removing this ransomware does not decrypt your files. You can only get your files back from backups you made before the infection happened.