BLACK FRIDAY: 2-for-1 offer NOVEMBER 20 - 26 See details
25
Global rank
40 infographic chevron month
Month rank
33 infographic chevron week
Week rank
0
IOCs

GandCrab is probably one of the most famous Ransomware. A Ransomware is a malware that asks the victim to pay money in order to restore access to encrypted files. If the user does not cooperate the files are forever lost.

Ransomware
Type
ex-USSR territory
Origin
26 January, 2018
First seen
14 September, 2024
Last seen

How to analyze GandCrab with ANY.RUN

Type
ex-USSR territory
Origin
26 January, 2018
First seen
14 September, 2024
Last seen

IOCs

IP addresses
18.132.18.63
217.26.60.254
136.243.162.140
195.15.227.239
217.26.53.161
128.65.195.174
77.75.249.22
103.138.88.36
168.206.51.90
67.227.236.96
185.105.4.112
217.8.117.33
172.96.14.134
51.83.128.59
217.61.17.155
51.15.241.96
49.51.163.133
8.208.83.31
80.249.146.244
188.68.221.93
Hashes
e22afdc8bb8605418fd39d974757aa5366a81478cfe312cb63b65c6ae3b69469
948dd30fa17435d0713696ccbb6ebc338cf3c7cc20227eb18a059ed5d31e67c2
a388d6bb4dc96264523b76b0a4e24dd1bffd312ec66c92e92cc6788bd56bf4ca
32eb04e246655e308e37c4eee731fc04ba84b907daaaacdcc2f76c74a724dbc5
73504a1e407eaab8c239a0a323bcc22ca6163e4fcd4c12c9beb2174a1ba05246
9c1ac77f687ad2bfe197e4a8f2b969d7caf4f8ddb707177b9461d7e74879ae33
6e6719cafd1e6e5c8b3ccaafd29fd446f80e8d81cd68c56bba506a8c25736d45
6745dbcbd02d0fb4a888c7d8e85ddda8620b10887c66de0caf8fc246e50beaba
3f3ed2e0b2dbdcf9f3b8f81641cb3e25259783af71f891757d68e201f519d467
73813c9fb2e304fd40978b6e8486852777b8c1fdc1b251228fb8af2ca69f97d4
161552a234278bdfb433d8ef5736a997b26d44124fdcba7643250a076346c2fe
a77e91f7f85b703862766df791b0cff9de647f67587f88655dc36812aad99f43
25414d4575bee4f84fc1b1662ada1e4032cf9fa9aceac49d717aae0a7a4821d0
d7ffa0d8566702474790d7cbbbf9d51e9937d82582f82e1a00ddb1c489700d62
67aa4fa825a8a99d4aa47be3644ef885f737fd5ca5f0e32af89c6aa48aa8d4d9
152211aed30ef90b2801d2b19d686dd5741f7fbc6f4009594057f5e82d87576c
e2c2e3f5bb6e456982b9d01c46937ed78584825901e44d2289c2e2e17b22375a
a183060aa1c0ba1a865e8e648aaa20ed636994ecc8750ee177a9b371ca79def9
881a10d38082c69f53117842ea68c37eb3dee9759e33698739ca654184034e7d
734af6c25c551cbe9d5b0d2ebc3d796d52c7d7ca8260a5b5cad95377d6a65b13
Domains
poketeg.com
gdcbghvjyqy7jclk.onion.top
perovaphoto.ru
menosita.top
perfectfunnelblueprint.com
gdcbghvjyqy7jclk.onion.casa
kakaocorp.link
doomaricom.ddns.net
pp-panda74.ru
wowservers.ru
cryptsen7fo43rr6.onion.to
gdcbghvjyqy7jclk.onion.guide
gdcbghvjyqy7jclk.onion.plus
alphyoworksplat.com
fabbfoundation.gm
gdcbghvjyqy7jclk.onion.rip
cryptsen7fo43rr6.onion
bon.aungercote.org
ver.sceinsheru.org
oblomoff.fun
URLs
http://cevent.net/news/imgs/hekaimimda.png
http://cevent.net/
http://www.poketeg.com/static/tmp/keru.jpg
http://www.poketeg.com/
http://www.poketeg.com/content/tmp/thkefu.bmp
http://www.poketeg.com/data/tmp/sodede.jpg
http://www.haargenau.biz/uploads/tmp/esamfu.bmp
http://www.haargenau.biz/
http://www.macartegrise.eu/
http://www.macartegrise.eu/news/images/kemoheda.png
http://www.macartegrise.eu/news/images/thso.bmp
http://www.wash-wear.com/data/pics/thzuhedameme.gif
http://www.wash-wear.com/
http://www.macartegrise.eu/wp-content/assets/kada.bmp
http://asl-company.ru/includes/image/semohe.jpg
http://asl-company.ru/
http://www.macartegrise.eu/wp-content/graphic/imzues.png
http://www.kakaocorp.link/includes/graphic/thseessomode.jpg
http://www.kakaocorp.link/
http://www.kakaocorp.link/data/imgs/daimso.jpg
Last Seen at

Recent blog posts

post image
ANY.RUN Now Integrates with Splunk!
watchers 314
comments 0
post image
How to Analyze Malware in ANY.RUN Sandbox: Er...
watchers 363
comments 0
post image
Security Training Lab: Educational Program fo...
watchers 1160
comments 0

What is GandCrab ransomware?

GandCrab is a ransomware-type malware, which means that it encrypts files on infected machines and demands a ransom in cryptocurrency to restore the lost data. What’s more, this particular strain is distributed as a Ransomware-As-A-Service, allowing anybody to use this program by purchasing access to a control dashboard.

A unique business model and constant updates of the malware, in turn, helped GandCrab to become one of the most widely spread ransomware of 2018.

General Description of GandCrab

Since its discovery on January 26, 2018, at least 5 versions of GandCrab were created. The authors of the program are extremely active and respond to created countermeasures almost instantly, making GandCrab an elusive malware that continues to terrorize private and corporate victims today.

The last identified version of the malware is 5.1 and it targets users from all over the world with one exception – having originated in an ex-USSR country GandCrab is known to ignore users from X-USSR territories, identifying them by the keyboard or UI language settings. Only Windows operating systems are affected by ransomware.

It should be noted, that the virus is assigned a different name by various antivirus software:

  • Ransom: Win32/GandCrab
  • Trojan.Ransom.GandCrab
  • Win32/Filecoder.GandCrab
  • Ransom.GandCrab
  • Trojan-Ransom.Win32.GandCrypt

Usually infecting users through mail spam or exploit kits, the ransomware redirects victims to a TOR website after the files on a victim’s PC are encrypted. For the newer versions of the malware, the only way of restoring the data is through paying the ransom, the amount of which usually fluctuates between 1000 and 3000 dollars. However, some victims, have reported that they were asked to pay as much as 700,000 USD.

Having a RaaS ( Ransomware-as-a-Service ) business model, GandCrab is distributed by the original creators to “clients”, who then deliver the malware to end victims, asking for a custom ransom amount through one of the unique features of the virus – customizable ransom notes. A percentage of the “revenue” is then shared with the malware authors, once a ransom is secured.

GandCrab malware analysis

ANY.RUN provides the ability to watch the GandCrab program in action in interactive virtual machine simulation. Notably, ANY.RUN simulation can be used to perform the analysis of the stages of the virus life cycle:

  • Infection. A victim downloads and opens infected Microsoft Office file which contains a script programmed to download and start the execution of the virus;
  • Execution and information gathering. After the script has started the execution process, GandCrab collects information about the user. At this stage, the execution of the virus is stopped if a Russian keyboard layout or user interface is detected;
  • The malware checks for the presence of antivirus drivers and stops all processes that involve files that it wants to encrypt;
  • The ransomware decrypts the ransom record held in the binary;
  • Next, a key pair is generated;
  • The virus enumerates file and decryptors;
  • GandCrab proceeds to encrypt the files;
  • The malware establishes communication with the server;
  • After that, the malware will try to delete all shadow copies;
  • Finally, a ransom note is displayed to the user.

wallpaper after infection by gandcrab ransomware

Figure 1: Some versions of GandCrab are known to change the desktop wallpaper. This function is omitted in version 5.0.

ransomnote displayed by gandcrab v5.1

Figure 2: A ransomware note displayed by GandCrab v5.1

The following contamination processes are launched by the ransomware:

  • Starts CMD.EXE for commands execution
  • Executes PowerShell scripts
  • Downloads executable files from the Internet
  • Connects to CnC server
  • Makes registry changes
  • Runs wmic.exe
  • Executes vssvc.exe
  • Deletes shadow copies
  • Runs NOTEPAD.EXE

The whole contamination process can be seen in a video, displaying the ANY.RUN simulation.

gandcrab execution process graph

Figure 3: Illustrates the processes launched by GandCrab during its life cycle.

To build itself into the system, GandCrab starts with decrypting an extension name record that is held in the binary. By going through logical drives from “a” to “z” the malware separates all drives that are equal to 0x2 and not equal to 0x5, creating and separating thread to enumerate and encrypt all data that is prepared for encryption. After the encryption is complete, the malware uses wmic to erase all shadow copies. As a result, all data remains affected by the program even after a reboot.

The ransomware leaves behind artifacts that can help to recognize the version. Those exist in the form of extensions of encrypted files.

  • Version 1 gives the .gdcb extension
  • Version 2 and 3 give the .crab extension
  • Version 4 gives the .krab extension
  • Version 5 gives a randomized 5 or more letter extension

How to avoid infection by GandCrab?

According to the analysis, creators of GandGrab patch all exploits in the malware code fairly quickly, which makes the development of countermeasures tricky. Upon contamination with on of the latest versions, the only way to restore the lost data is to pay the ransom. Thus, the best way to stay safe is to prevent contamination.

  • By keeping digital copies of important files in multiple places
  • By making sure that the antivirus software is reliable and updated
  • Avoiding digital downloads on suspicious or unknown websites
  • Avoiding opening the attached files in emails, especially those coming from unknown senders.
  • And not paying the ransom if infected.

That said, effective countermeasures do exist for older versions of the ransomware like Troldesh or Nemty, including free decrypters and Killswitches. Most notably, a Killswitch for GandCrab v4.1.2 was developed by a cyber threat analysis and response company Ahnlab. The defensive application exploits the mechanics of GandCrab ransomware by creating a file with the .lock extension, which simulates the files that GandCrab itself generates and uses to check whether the victim's computer is included in the record of previously affected machines to avoid double decryption.

The execution of the ransomware stops upon discovery of .lock file if it is placed in %Application Data% for Windows versions before Windows 7 and in %ProgramData% directory for newer OS versions. Even in cases when the malware has already activated, the killswitch will prevent some of the damage.

Interestingly, in response to the killswitch, the GandCrab authors released an exploit, targeting the Ahnlab antivirus software. The exploit was introduced in version v4.2.1 and v4.3 of the malware but did not cause sufficient harm to the antivirus users.

For versions 1, 4 and up through 5.1 there are free decryption tool from Bitdefender.

Distribution of GandCrab

Based on the analysis, ransomware is known to utilize multiple attack vectors, however, compromised list and spam email campaigns are the most commonly used delivery channels. Being delivered to users in spam emails, GandCrab tricks users into downloading a ZIP archive that contains a script file that triggers the download and execution.

GandCrab execution process and technical malware analysis

An illustration of an execution process can be found below.

gandcrab execution process tree

Figure 4. Malware analysis of the GandCrab execution process in ANY.RUN

The following behavioural activities are shown in ANY.RUN’s malware analysis report.

text report of the gandcrab ransomware analysis

Figure 5: A text report created in ANY.RUN

During the execution the malware creates several artifacts that can be viewed in detail in the ANY.RUN simulation.

With file encryption being the main goal of the payload, the malware launches a command line with pre-specified parameters after opening a Microsoft Word file. Startup powershell is then sent as command line parameters, followed by downloading and launching the executable file from the Internet.

How to detect Gandcrab using ANY.RUN?

You can perform malware analysis of files using ANY.RUN's "Static Discovering". Open either "Files" tab in the lower part of the task's window or click on the process and then on the button "More Info" in the appeared window. After that, all you need to do is just click on the file.

gandcrab ransom note

Figure 6: Gandcrab ransom note

Conclusion

Thanks a unique business model which involves selling the program as a service and defining characteristics like customizable ransom notes, GandCrab’s popularity quickly escalated in 2018, making the virus the most widely spread ransomware of the year.

Unfortunately, the creators proved to be very active and continued to respond quickly to all attempts to create effective countermeasures. While adhering to common practices of staying safe on the internet decreases the probability of getting attacked greatly, running interactive sandbox malware analysis in a service such as ANY.RUN is the best way to ensure personal or corporate safety.

P.S.

On the 1st June 2019 creators of the GandCrab ransomware made a post in which they stating that they have generated more than $2 billion in ransom payments, with average weekly payments of $2.5 million dollars. They also said that they have personally earned $150 million, which they have cashed out and invested in legal business entities. In the same post, they announced about ending of distributing the program within 20 days and that keys will be deleted.

HAVE A LOOK AT

Adwind screenshot
Adwind
adwind trojan
Adwind RAT, sometimes also called Unrecom, Sockrat, Frutas, jRat, and JSocket, is a Malware As A Service Remote Access Trojan that attackers can use to collect information from infected machines. It was one of the most popular RATs in the market in 2015.
Read More
Agent Tesla screenshot
Agent Tesla
agenttesla trojan rat stealer
Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold.
Read More
Amadey screenshot
Amadey
amadey
Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.
Read More
Arkei screenshot
Arkei
arkei stealer
Arkei is a stealer type malware capable of collecting passwords, autosaved forms, cryptocurrency wallet credentials, and files.
Read More
AsyncRAT screenshot
AsyncRAT
asyncrat
AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions.
Read More
WarZone screenshot
WarZone
warzone avemaria stealer trojan rat
WarZone RAT is a remote access trojan, which is written in C++ and offered as a malware-as-a-service. It packs a wide range of capabilities, from stealing victims’ files and passwords to capturing desktop activities. WarZone RAT is primarily distributed via phishing emails and receives regular updates from its C2.
Read More