Do not have time to read full article and want this article in PDF format in your email.Enter your Email Address
You may be familiar with GandCrab ransomware that seems to widely spread via various spam campaigns or social engineering techniques to infect and harvest users’ most important data.This fast-growing malware has infected more than 50,000 victims and targeting mostly the ones from Scandinavia and UK speaking countries, according to a report CheckPoint.
Security researchers recently analyzed a new spam campaign in which malicious actors try to lure victims into clicking a malicious link that will open a binary file and infect users’ system with the GandCrab ransomware.
This phishing campaign has been delivered with the following content (sanitized for your own protection).
Here’s how this email looks like:
From: [Spoof / Forwarded Sender Address]
Job: Banking Opportunities, Greymouth
Dear Hiring Manager
Please review my [link: http: // abuellail [.] Com / resume. php] resume
Email: charlotte.anderson @ abuellail [.] com
If a user clicks on the link received on the email, then he will be redirected to one of the following and compromised web pages (sanitized for your online safety):
test.ritsdb [.] com
ubsms [.] com
test.technostark [.] com
How the infection happens
Basically, the malware is spread via an executable binary file (resume.exe) which is returned after GandCrab is running on the local machine as a file called “bhxsew.exe”.
During the process, the ransomware will try to collect and determine the external IP addresses of the victims via legitimate services such as:
Http: // ipv4bot.whatismyipaddress. com
Http: / /bot.whatismyipaddress. Com
The main component of GandCrab is “dropped” as a “bhxsew.exe” file in the directory. As part of the local data encryption, this malicious file is configured to communicate with the following domains:
zone alarm [.] bit
ransomware [.] bit
GandCrab ransomware is not spread only via spam emails but also seen distributed via an exploit kit campaign called MagnitudeEK which abuses software vulnerabilities found in Windows, Adobe Flash Player, and Silverlight.
As regards to the MagnitudeEK spam campaign, security researchers have seen a flood of subdomains being used via this site:
lieslow [.] faith
Malwarebytes Labs recently found that Magnitude EK, “which had been loyal to its own Magniber ransomware, was now being leveraged to push out GandCrab, too.”
Here’s how the ransom note is displayed on the infected machine:
Magnitude has always experimented with unconventional ways to load its malware, for example via binary padding, or more recently via another technique, but still exposing it “in the clear” from traffic or network packet capture.
Upon successful infection, files will be encrypted with the .CRAB extension while a ransom note is left with instructions on the next steps required to recover those files.
According to VirusTotal, 32 antivirus products out of 66 have detected this spam email campaign at the time we write this security alert.
How to stay safe from the GandCrab ransomware
One of the best ways to keep your important data safe from ransomware is to think and act proactively.
To minimize both the risks and the impact of these online threats, we recommend both home users and companies to use and apply these security measures:
- Always backup your data and use external sources such as a hard drive or in the cloud (Google Drive, Dropbox, etc.) to store it.
- DO NOT open (spam) or download attachments or links from unknown sources that could infect your computer;
- Use strong and unique passwords and never reuse them for multiple accounts. Consider using a paid proactive antivirus software which is also up to date..
- Prevention is the best cure, so make sure you learn as much as possible about how to easily detect spam emails.
- Given the rise of new types of malware we remind you that security is not just about using a solution or another, it’s also about improving your online habits and being proactive.
If you’ve been a victim of the GandCrab ransomware, the good news is that there’s a decryption tool available you can use to recover the valuable data locked by ransomware.