Generally distributed using RigEK toolkit, Gandcrab ransomware demands payment in DASH cryptocurrency. It utilizes “.bit” top level domain and when once it is injected into your computer system it encrypts the data & adds “.GDCB” extension to all the compromised files. For example, imagesample123.jpg (the original file) changes to imagesample123.jpg.GDCB (the infected file). After encryption, the ransomware generates a “GDCB-DECRYPY.txt” file and places a copy in each existing folder and when the victim tries to open a file it shows up a message that contains information regarding their files being encrypted and instructs what needs to be done next.
The files can be decrypted using a unique key which is stored on a remote server that is controlled by developers of the ransomware. To get that key the victim is generally required to pay 1.5 Dash cryptocurrency which is equivalent to approximately $1130. However, there is no guarantee that your files will be decrypted even after you pay the ransom amount.
Most Common Ways Through Which The Ransomware Can Infect You
- It can reach your system when you use third party software download sources.
- Spam emails or emails sent from untrusted sources often contain malicious attachments which when opened install malware into your system.
- Sometimes your system can get infected through Peer-to-Peer (P2P) networks which install malicious executables by masquerading them as legitimate software’s.
- Victim often fall prey of fake software updaters which infiltrate into their system.
- Trojans are another reason that can cause a ransomware attack. They exploit the system and also allow such malwares to be injected in the system.
How To Protect Yourself Against The Ransomware
- Make sure that you backup your data on a regular basis because if once your files are decrypted by the ransomware, the chances of recovering your data even after paying the ransom amount are meagre.
- If you are unsure about an email sent from an untrusted source then it is highly advisable to not download the attachments sent along.
- Ensure that none of the computers are running remote desktop services and are connected to the internet directly. Instead, make sure that they can only be accessed by logging into a VPN first.
- Download all the Windows updates as soon as they are launched since older versions might contain certain loopholes which may be exploited by the attackers.
- Make sure that you do not use weak passwords. Also it is important to note that no matter how easy it might seem to have a single password for multiple logins, it should always be avoided as it opens the doors for such attacks in which your confidential data & files might be compromised.
For more information about Cyber Security, call Centex Technologies at (254) 213-4740