It is distributed through exploit kits.
Some of its features have not been used before by any similar malware.
One of these singularities is that it has been the first ransomware to accept the DASH cryptocurrency.
We recently saw that cybercriminals had put aside Bitcoin to accept payments when they infected victims with ransomware.
On this occasion, GandCrab managers ask for a rescue through DASH.
This is one of the many cryptocurrencies we can find today.
It is one of those that are hovering around the top 10 in capitalization.
DASH was built with privacy as a goal.
That is why its tracking is much more difficult on the part of the police.
This favours the use of cybercriminals.
As we know, the function of ransomware is to encrypt the files and folders of a computer.
In return, the cybercriminal asks for an economic rescue to free them.
This rescue in many cases is through a cryptocurrency.
Bitcoin or, in this case, DASH.
Recently we also saw the case of HC7, the first ransomware that used Ethereum as a payment method.
Returning to GandCrab, it was discovered by security researcher David Montenegro.
The researchers quickly came together to analyze the ransomware and publish their results on Twitter.
Unfortunately, at this time there is no way to decrypt files encrypted by GandCrab for free.
This kit tries to use vulnerabilities in the visitors software to install GandCrab without their permission.
Another interesting and novel feature is the use of GandCrab of the high-level domain NameCoin .BIT.
GandCrab uses these .bit domains as addresses for its command and control servers.
As we always say, the best protection against ransomware is to make backups frequently.
Also, common sense is important.
This is so since most of this throw in of malware requires user interaction.
So, what do you think about this?
Simply share all your views and thoughts in the comment section below.
