GandCrab

GandCrab is probably one of the most famous Ransomware. A Ransomware is a malware that asks the victim to pay money in order to restore access to encrypted files. If the user does not cooperate the files are forever lost.

Type
Ransomware
Origin
ex-USSR territory
First seen
26 January, 2018
Last seen
31 March, 2020
Global rank
14
Week rank
19
Month rank
27
IOCs
5170

What is GandCrab ransomware?

GandCrab is a ransomware type malware, which means that it encrypts files on infected machines and demands a ransom in cryptocurrency to restore the lost data. What’s more, this particular strain is distributed as a Ransomware-As-A-Service, allowing anybody to use this malware by purchasing access to a control dashboard.

Unique business model and constant updates of the malware, in turn, helped GandCrab to become one of the most widely spread ransomware of 2018.

General Description of GandCrab

Since its discovery on January 26, 2018, at least 5 versions of GandCrab were created. The authors of the ransomware are extremely active and respond to created countermeasures almost instantly, making GandCrab an elusive malware that continues to terrorize private and corporate victims today.

The last identified version of the malware is 5.1 and it targets users from all over the world with one exception – having originated in an ex-USSR country GandCrab is known to ignore users from X-USSR territories, identifying them by the keyboard or UI language settings. Only Windows operating systems are affected by the ransomware.

It should be noted, that the virus is assigned a different name by various antivirus software:

  • Ransom:Win32/GandCrab
  • Trojan.Ransom.GandCrab
  • Win32/Filecoder.GandCrab
  • Ransom.GandCrab
  • Trojan-Ransom.Win32.GandCrypt

Usually infecting users through mail spam or exploit kits, the ransomware redirects victims to a TOR website after the files on a victim’s PC are encrypted. For the newer versions of the malware, the only way of restoring the data is through paying the ransom, the amount of which usually fluctuates between 1000 and 3000 dollars. However, some victims, have reported that they were asked to pay as much as 700,000 USD.

Having a RaaS ( Ransomware-as-a-Service ) business model, GandCrab is distributed by the original creators to “clients”, who then deliver the malware to end victims, asking for a custom ransom amount through one of the unique features of the virus – customizable ransom notes. A percentage of the “revenue” is then shared with the malware authors, once a ransom is secured.

GandCrab malware analysis

ANY.RUN provides the ability to watch the GandCrab malware in action in interactive virtual machine simulation. Notably, ANY.RUN simulation can be used to view the stages of the virus life cycle:

  • Infection. A victim downloads and opens infected Microsoft Office file which contains a script programmed to download and start the execution of the virus
  • Execution and information gathering. After the start of the execution process, GandCrab collects information about the user. At this stage, the execution of the virus is stopped if a Russian keyboard layout or user interface is detected;
  • The malware checks for the presence of antivirus drivers and stops all processes that involve files that it wants to encrypt;
  • The ransomware decrypts the ransom record held in the binary;
  • Next, a key pair is generated;
  • The virus enumerates file and decryptors;
  • GandCrab proceeds to encrypt the files;
  • The malware establishes communication with the server;
  • After that, the malware will try to delete all shadow copies;
  • Finally, a ransom note is displayed to the user.

wallpaper after infection by gandcrab ransomware

Figure 1: Some versions of GandCrab are known to change the desktop wallpaper. This function is omitted in version 5.0.

ransomnote displayed by gandcrab v5.1

Figure 2: A ransomware note displayed by GandCrab v5.1

The following contamination processes are launched by the ransomware:

  • Starts CMD.EXE for commands execution
  • Executes PowerShell scripts
  • Downloads executable files from the Internet
  • Connects to CnC server
  • Makes registry changes
  • Runs wmic.exe
  • Executes vssvc.exe
  • Deletes shadow copies
  • Runs NOTEPAD.EXE

The whole contamination process can be seen in a video, displaying the ANY.RUN simulation.

gandcrab execution process graph

Figure 3: Illustrates the processes launched by GandCrab during its life cycle.

To build itself into the system, GandCrab starts with decrypting an extension name record that is held in the binary. By going through logical drives from “a” to “z” the malware separates all drives that are equal to 0x2 and not equal to 0x5, creating and separating thread to enumerate and encrypt all data that is prepared for encryption. After the encryption is complete, the malware uses wmic to erase all shadow copies. As a result, all data remains affected by the ransomware even after a reboot.

The ransomware leaves behind artifacts that can help to recognize the version. Those exist in the form of extensions of encrypted files.

  • Version 1 gives the .gdcb extension
  • Version 2 and 3 give the .crab extension
  • Version 4 gives the .krab extension
  • Version 5 gives a randomized 5 or more letter extension

How to avoid infection by GandCrab?

Creators of GandGrab patch all exploits in the malware code fairly quickly, which makes the development of countermeasures tricky. Upon contamination with on of the latest versions, the only way to restore the lost data is to pay the ransom. Thus, the best way to stay safe is to prevent contamination.

  • By keeping digital copies of important files in multiple places
  • By making sure that the antivirus software is reliable and updated
  • Avoiding digital downloads on suspicious or unknown websites
  • Avoiding opening the attached files in emails, especially those coming from unknown senders.
  • And not paying the ransom if infected.

That said, effective countermeasures do exist for older versions of the ransomware, including free decrypters and Killswitches. Most notably, a Killswitch for GandCrab v4.1.2 was developed by a cyber threat analysis and response company Ahnlab. The defensive application exploits the mechanics of GandCrab ransomware by creating a file with the .lock extension, which simulates the files that GandCrab itself generates and uses to check whether the victim's computer is included in the record of previously affected machines to avoid double decryption.

The execution of the ransomware stops upon discovery of .lock file if it is placed in %Application Data% for Windows versions before Windows 7 and in %ProgramData% directory for newer OS versions. Even in cases when the malware has already activated, the killswitch will prevent some of the damage.

Interestingly, in response to the killswitch, the GandCrab authors released an exploit, targeting the Ahnlab antivirus software. The exploit was introduced in version v4.2.1 and v4.3 of the malware but did not cause sufficient harm to the antivirus users.

For versions 1, 4 and up through 5.1 there are free decryption tool from Bitdefender.

Distribution of GandCrab

The ransomware is known to utilize multiple attack vectors, however, compromised list and spam email campaigns are the most commonly used delivery channels. Being delivered to users in spam emails, GandCrab tricks users into downloading a ZIP archive which contains a file that triggers the download and execution.

GandCrab execution process

An illustration of an execution process can be found below.

gandcrab execution process tree

Figure 4. Analysis of the GandCrab execution process in ANY.RUN

The following behavioural activities are shown in ANY.RUN’s report.

text report of the gandcrab ransomware analysis

Figure 5: A text report created in ANY.RUN

During the execution the malware creates several artifacts that can be viewed in detail in the ANY.RUN simulation.

With file encryption being the main goal of the payload, the malware launches a command line with pre-specified parameters after opening a Microsoft Word file. Startup powershell is then sent as command line parameters, followed by downloading and launching the executable file from the Internet.

How to detect Gandcrab using ANY.RUN?

You can take a look inside files using ANY.RUN's "Static Discovering". Open either "Files" tab in the lower part of the task's window or click on the process and then on the button "More Info" in the appeared window. After that, all you need to do is just click on the file.

gandcrab ransom note

Figure 6: Gandcrab ransom note

Conclusion

Thanks a unique business model which involves selling the ransomware as a service and defining characteristics like customizable ransom notes, GandCrab’s popularity quickly escalated in 2018, making the virus the most widely spread ransomware of the year.

Unfortunately, the creators proved to be very active and continued to respond quickly to all attempts to create effective countermeasures. While adhering to common practices of staying safe on the internet decreases the probability of getting attacked greatly, running interactive sandbox simulations in a service such as ANY.RUN is the best way to ensure personal or corporate safety.

P.S.

On the 1st June, 2019 creators of the GandCrab ransomware made a post in which they stating that they have generated more than $2 billion in ransom payments, with average weekly payments of $2.5 million dollars. They also said that they have personally earned $150 million, which they have cashed out and invested in legal business entities. In the same post, they announced about ending of distributing the ransomware within 20 days and that keys will be deleted.

IOCs

IP addresses
164.132.235.17
204.11.56.48
66.171.248.178
213.186.33.4
192.168.100.4
209.99.40.222
217.70.184.50
213.186.33.5
188.165.53.185
18.213.250.117
37.187.171.185
35.246.6.109
18.215.128.143
185.102.136.129
213.186.33.3
50.63.202.62
213.186.33.17
209.99.64.53
103.224.212.222
91.195.240.94
Hashes
c56f552d4e78bea25a724327d8c66a6f52d851e44d445c5007e3c03e5b33b867
01f5ecacb43227299477c0c0cd8c71b14f623714005c1b88d53950e316f4f2d3
f13c477ae96c78a1aac0505b461fa37a900362c065bff74f49f50a4456d546bb
1c70fefb27171685505d013e7a8a4c47a7ac30654354f244d265150cbc56be4d
e906f1c983c7c2756f4bcd4de9edb2c6e8d16c1f84a18fecf15b698a459183fc
4fb5ea4fd30838756fa643c399c3d82e952f60e25de4127c4d0b9849dc617d1e
3ebec93588b67b77545bb9aaf353fc66911c2ea7f4cfee86b93581dea95fabf1
67a6277e600ebcd68baaf0757f4d8e3320a4f3a547ca369dd3dbf81fd5ddcb1f
063cf82cd52acb6a0539a6ff59f72fb5de473293a06c470a92c6d35a151b73e9
d77d12e904c1637d286ecfb662cec9ab6d8ad43088253b4f9ad668a85a4ae18a
6fad23280be0b6b6f5cf6308e3bf23321ddc99b68e420ed9f98696b90ae912d9
ce093ffa19f020a2b73719f653b5e0423df28ef1d59035d55e99154a85c5c668
13507f1f60e81e3fcfc2244f5b9e4f5d9d04c6f0beaa34429879afdb24720c07
a89ff5da7c1c949768bd1f83fede6a02363ec8082b057aa34ea627d4ac81de8a
39d000d2c4b8016d4b8efb75ed99272b925a789ef35248e492f51149cc4712a5
2942708537ed2607d9b8787539ca1a9bdea9247c78ef7ece4302df5e5c6e6d00
ca7105c907ddc746eebcc6c845b2a7b4795b4cb9d7ec55972a6ea62aa7bdca9d
9e44a9653ea97f015a183d4b98d9deee6dd59cb664d4992cc0ea815943141ece
a2a1b1e7c281f3b63c37e7eab69b738b3ed6663ecaa427ca36022877b44d0f19
6c1ed5eb1267d95d8a0dc8e1975923ebefd809c2027427b4ead867fb72703f82
Domains
oththukaruva.com
myleftheart.com
musk-giveaway.com
www.tiltmediaproductions.com
online-sale24.com
www.studiofourteen40.com
www.operationsbasednavigation.com
coreupdate.msoftupdates.com
cthree.msoftupdates.com
ctwo.msoftupdates.com
cone.msoftupdates.com
89gospel.com
bidroll.com
my.gobiox.com
tangotangocash.com
alem.be
www.antanda.com
majul.com
elx01.knas.systems
inescogroup.com

HAVE A LOOK AT

Adwind screenshot
Adwind
adwind trojan
Adwind RAT, sometimes also called Unrecom, Sockrat, Frutas, jRat and JSocket is a Malware As A Service Remote Access Trojan that attackers can use to collect information from infected machines. It was one of the most popular RATs in the market in 2015.
Read More
Agent Tesla screenshot
Agent Tesla
agenttesla trojan rat stealer
Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold.
Read More
Ave Maria screenshot
Ave Maria
avemaria stealer trojan rat
Ave Maria malware is a Remote Access Trojan that is also called WARZONE RAT. Hackers use it to control PCs of their victims remotely and steal information from infected PCs. For example, they can remotely activate the camera to take pictures of a victim and send them to a control server
Read More
Azorult screenshot
Azorult
azorult trojan rat
AZORult can steal banking information including passwords and credit card details as well as cryptocurrency. This constantly updated information stealer malware should not be taken lightly, as it continues to be an active threat.
Read More
Crimson RAT screenshot
Crimson RAT
crimson rat trojan
Crimson is a Remote Access Trojan — a malware that is used to take remote control of infected systems and steal data. This particular RAT is known to be used by a Pakistani founded cybergang that targets Indian military objects to steal sensitive information.
Read More
Danabot screenshot
Danabot
danabot trojan stealer
Danabot is an advanced banking Trojan malware that was designed to steal financial information from victims. Out of the Trojans in the wild this is one of the most advanced thanks to the modular design and a complex delivery method.
Read More