What is GANDCRAB V2.1 ransomware? And how does it execute its attack?

GANDCRAB V2.1 ransomware is a new version of the GandCrab v2 ransomware. This new variant uses the .CRAB extension in marking its encrypted files. Once the .js file of this crypto-virus is clicked, it will trigger a malicious JavaScript code. As a result, the malicious executable file of this ransomware is dropped into the system. The malicious executable file is placed under the %AppData% folder and is reported to have these parameters:
SHA256 hash:
9282ffd0f7aef39febc84f33a3090898e2fae6236cae7465a21ca58978d81b86
Size: 265,224 bytes
Location: %AppData%\RoamingiqB44.exe
Note that the malicious payload of this crypto-malware is also using other names. Meaning to say, it has random names but is generally placed in the very same directory. According to security experts, the malicious payload can be identified if you create a Windows Registry entry in this Windows sub-key – HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce. In this sub-key, you might see a value string which is named randomly and contains the actual name and location of the malicious executable file. After the malicious file is executed, GANDCRAB V2.1 ransomware might attempt to establish a connection with one of its hosts and servers.
During the encryption, this crypto-malware uses a sophisticated encryption algorithm that alters some portion of the file’s data – making it impossible for victims to open them. After that, it creates a file named “CRAB-DECRYPT.txt” that contains the following message:
“GANDCRAB v2.1
Attention!
All your files documents. photos databases and other important files are encrypted and have the extension: .CRAB
The only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.
The server with your key is in a closed network TOR. You can get there by the following ways:

1. Download Tor browser – https://www.torproject.org/
2. Install Tor browser
3. Open Tor Browser
4. Open link in TOR browser: http://gandcrab2pie73et.onion/f6e46a9cb4dae302
5. Follow the instructions on this page

If Tor/Tor browser is locked in your country or you can not install it. open one of the following links in your regular browser:
{tor links here}
ATTENTION! Use regular browser only to contact us. Buy decrypt or only through TOR browser link or Jabber Bot!
On our page, you will see instructions on payment and get the opportunity to decrypt 1 file for free.
The alternative way to contact us is to use Jabber messenger. Read how to:

1. Download Psi-Plus Jabber client: https://psi-im.org/download/
2. Register a new account: http://sgams/register.php

0? Enter “username”: {crooks’ provided ID}
1) Enter “password”: your password

2. Add a new account in Psi
3. Add and write Jabber ID: ransomwareesj.ms any message
4. Follow instruction bot

It is a bot! It’s fully automated artificial system without human control!
TO contact us use TOR inks. we can provide you all required proofs of decryption available anytime. we are open to conversations.
You can read instructions how to install and use jabber here ttp://www.sfu.ca/jabber/Psi_Jab er_Pc.pdf
DANGEROUS!
Do not try to modify files or use your own private key – this will result in the loss of your data forever!”
How does GANDCRAB V2.1 ransomware proliferate?
GANDCRAB V2.1 ransomware uses malicious spam emails to proliferate. These spam emails carry JavaScript files and pretend as if they are legitimate PDF files that are archived within the .7z file. Once the .7z archive is opened, the contents of it are uncovered and once these contents are opened, GANCRAB V2.1 ransomware will be downloaded and installed in the system.
Make sure to carefully follow the removal instructions below to completely terminate GANDCRAB V2.1 ransomware from your computer.
Step 1: The first thing you need to do is to obliterate the process of GANDCRAB V2.1 ransomware by opening the Task Manager – simply tap the Ctrl + Shift + Esc keys on your keyboard.
Step 2: After that, click the Processes tab and look for any suspicious-looking process that takes up most of your CPU’s resources and is most likely related to GANDCRAB V2.1 ransomware and then end its processes.

Step 3: Now that the malicious process is eliminated, close the Task Manager.
Step 4: Next, tap Win + R, type in appwiz.cpl and click OK or tap Enter to open Control Panel’s list of installed programs.
Step 5: Under the list of installed programs, look for GANDCRAB V2.1 ransomware or anything similar and then uninstall it.

Step 6: Then close Control Panel and tap Win + E keys to launch File Explorer.
Step 7: Navigate to the following locations below and look for GANDCRAB V2.1 ransomware’s malicious components like the RoamingiqB44.exe file, CRAB-DECRYPT.txt, as well as other suspicious files it has created and downloaded into the system and then delete all of them.

• %APPDATA%
• %TEMP%
• %WINDIR%\System32\Tasks
• %APPDATA%\Microsoft\Windows\Templates\
• %USERPROFILE%\Downloads
• %USERPROFILE%\Desktop

Step 8: Close the File Explorer.
Before you go on any further, make sure that you are tech savvy enough to the point where you know exactly how to use and navigate your computer’s Registry. Keep in mind that any changes you make will highly impact your computer. To save you the trouble and time, you can just use [product-name] this system tool is proven to be safe and excellent enough that hackers won’t be able to hack into it. But if you can manage Windows Registry well, then, by all means, go on to the next steps.
Step 9: Tap Win + R to open Run and then type in regedit in the field and tap enter to pull up Windows Registry.

Step 10: Navigate to the following path:

• HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
• HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\Background
• HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Personalization
• HKEY_CURRENT_USER\Control Panel\Desktop\ScreenSaveTimeOut
• HKEY_CURRENT_USER\Control Panel\Desktop

Step 11: Delete the registry keys and sub-keys created by GANDCRAB V2.1 ransomware.
Step12. Close the Registry Editor and empty the Recycle Bin.
Try to recover your encrypted files using the Shadow Volume copies
Restoring your encrypted files using Windows’ Previous Versions feature will only be effective if GANDCRAB V2.1 ransomware hasn’t deleted the shadow copies of your files. But still, this is one of the best and free methods there is, so it’s definitely worth a shot.
To restore the encrypted file, right-click on it and select Properties, a new window will pop-up, then proceed to Previous Versions. It will load the file’s previous version before it was modified. After it loads, select any of the previous versions displayed on the list like the one in the illustration below. And then click the Restore button.

After you’ve covered the steps provided above, you need to continue the removal process using a reliable program like [product-name]. How? Follow the advanced removal steps below.
Perform a full system scan using [product-code]. To do so, follow these steps:

1. Turn on your computer. If it’s already on, you have to reboot
2. After that, the BIOS screen will be displayed, but if Windows pops up instead, reboot your computer and try again. Once you’re on the BIOS screen, repeat pressing F8, by doing so the Advanced Option shows up.

3. To navigate the Advanced Option use the arrow keys and select Safe Mode with Networking then hit
4. Windows will now load the SafeMode with Networking.
5. Press and hold both R key and Windows key.

6. If done correctly, the Windows Run Box will show up.
7. Type in the URL address, [product-url] in the Run dialog box and then tap Enter or click OK.
8. After that, it will download the program. Wait for the download to finish and then open the launcher to install the program.
9. Once the installation process is completed, run [product-code] to perform a full system scan.

10. After the scan is completed click the “Fix, Clean & Optimize Now”button.