A new strain of the notorious GandCrab ransomware family, called GANDCRAB 5.1.0 has been released in the wild and infections with it have been reported. This strain follows the classic infection behavior by encrypting files on the target computers and coercing the victims into paying them a decryption fee. If your computer has been infected by this instance of GandCrab ransomware, we suggest that you read the following article as it explains more about GANDCRAB 5.1.0 and aims to show how to remove it and how you can attempt to recover encrypted files by yourself.
|Short Description||The GANDCRAB 5.1.0 ransomware is a variant of GandCrab family and encrypts files on your computer system and demands a ransom to be paid to decode them.|
|Symptoms||The ransomware will encrypt your files adding a random file extension and leave a ransom note with payment instructions.|
|Distribution Method||Spam Emails, Email Attachments|
|Detection Tool|| See If Your System Has Been Affected by GANDCRAB 5.1.0 |
Malware Removal Tool
|User Experience||Join Our Forum to Discuss GANDCRAB 5.1.0.|
|Data Recovery Tool||Windows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.|
GANDCRAB 5.1.0 – Distribution Techniques
The GandCrab 5.1.0 ransomware sample is being distributed using the common methods attributed to the GandCrab family of malware. Most of the infections are caused through exploit kits that coordinate the attacks mainly through phishing email messages that impersonate legitimate notifications from web services or software companies. The users are coerced to interact with them in some way — to open a file, download a script or run a certain interactive element. The code that will lead to the Gandcrab 5.1.0 infection can be found in basically every element — pop-up, redirects, images and etc.
The criminals can additionally opt to create malicious web pages that may impersonate vendor download pages, portals or other sites that the users can access and infect themselves with the GandCrab ransomware samples. They will use stolen design elements, text and layout that can impersonate the real web sites. To further manipulate the victims similar sounding domain names and stolen security certificates.
Infected payload carriers may also be the cause of contaminated hosts, there are two popular types:
- Application Installers — The malware code can be embedded in the setup files of popular programs that are downloaded by end users: system utilities, creativity programs, productivity and office solutions and etc. Even simply running the file can lead to a successful GandCrab 5.1.0 infection.
- Infected Documents — The other method used to infect files targets documents of all popular types: spreadsheets, presentations, text files and databases. Whenever they are opened by the users a prompt will appear asking them to enable the built-in macros (scripts) in order to view the document or interact with its built-in fields. If this action is done the virus will be deployed to the target machines.
We have received confirmation that GandCrab ransomware is widely distributed across file-sharing networks and BitTorrent in particular. This peer-to-peer technology is widely used to share both legitimate content and also pirate software, cracks and games.
Infections with this threat can also be caused through the installation of malware plugins made for the most popular web browsers, alternatively known as browser hijackers. They are uploaded to the relevant repositories using fake developer credentials and user reviews in order to coerce the users into downloading and installing them. The descriptions will offer promises of new features or performance optimizations. Instead of this when installed they will change the settings of the browsers in order to redirect the users to a scam landing page. At the same time the ransomware threat will be deployed alongside it.
GANDCRAB 5.1.0 – Detailed Analysis
Like previous GandCrab versions the security analysis of the captured GandCrab 5.1.0 ransomware samples reveals a complex infection scheme.
When the virus is introduced on the victim machine the engine will deploy the threat as a persistent infection. This means that it will modify the operating system settings, boot options and important configuration files in order to automatically start itself every time the computer is started. This is very dangerous as it practically renders many manual user removal guides non-working, in this event the victims may need to use a quality anti-spyware solution to completely restore their systems.
Another function that is called by the engine is the security bypass which will search the operating system for security software or services that may be installed. Their real-time engines will be disabled in order to block detection of the malware. Some advanced samples may additionally delete themselves if they fail this step. It can also detect whether or not the instance is run inside a virtual machine or a debug environment. This is another dangerous tactic which makes security analysis very difficult.
When these steps have completed information harvesting will take place. The typical cases usually group the data in two main categories:
- Personal Information — This group of data can directly reveal personal information bout the computer user: their name, address, phone number, location and any stored account credentials. This is possible thanks to the possibility of the GandCrab 5.1.0 ransomware engine to search the local hard drive contents, memory and other sources of data.
- Machine Identification — Ransomware strains like this one assign an unique ID which is made based on input values that are collected by the engine. The required data is obtained from the list of installed hardware parts, user settings and operating system conditions.
When all of these components have finished running the virus will proceed with System modifications, particularly ones concerning the Windows Registry. Modifications made to strings belonging to the operating system can result in serious problems with the stability of the affected machines. Modifications to third-party applications can render them completely unusable.
What’s more dangerous is that the virus can connect to a hacker-controlled server via a Trojan horse client with the TOR Hidden service. This anonymous network connection will report of the made infection and make it possible for the malicious operators to steal user data before the encryption takes place, take over control of the machines and deploy other threats.
GANDCRAB 5.1.0 – Encryption Process
As soon as all prior modules have completed running the ransomware component will be started. A built-in list of target file type extensions will be used to choose which user data to process with the powerful cipher:
The resulting data will be renamed with a randomly generated 6-character extension. Users can recognize the infection by looking at their wallpaper which will be changed with the ransomware note. Additionally the text can be copied in files that are found in various folders on the local hard disk drive.
Remove GANDCRAB 5.1.0 Virus and Try Restoring Data
If you are a victim of GANDCRAB v5.1.0 ransomware, you should get rid of this ransomware as quickly as possible before it replicates on other devices and infects them. You should remove the ransomware virus, preferably by following the manual or automatic removal steps underneath. They have been made with the main goal to help you detect and delete the virus files of GandCrab either manually or automatically. For best results, it is highly advisable to download and run a scan with a reputable anti-malware program. Such software aims to detect and remove all GANDCRAB 5.1.0-related files and objects automatically and also aims to ensure future threat protection.
If you want to recover files, encrypted by this GANDCRAB 5.1.0 variant, we would advise you to follow the file recovery methods below. We have created them to help users to try and restore as many files as possible, although the methods come with no 100% guarantee to work.