GIBCRYPTO is a destructive ransomware variant implemented as a .NET PE executable, first observed on February 22, 2026 targeting systems in Germany. The malware represents a dangerous convergence of ransomware and wiper capabilities, with a shared command-and-control infrastructure linking it to the well-known Snake Keylogger malware family.

Upon execution, GIBCRYPTO follows a multi-stage attack chain. The malware first displays a ransom note and locks the user interface to prevent interaction. It then activates keylogging functionality to capture credentials and other sensitive input. Before encrypting files, GIBCRYPTO performs several defense evasion actions: it bypasses the Windows Antimalware Scan Interface (AMSI) through inline patching of the AmsiScanBuffer function, overwriting its first 6 bytes with the opcodes B8 57 00 07 80 C3, which forces the function to return error code 0x80070057 and immediately exit, effectively disabling PowerShell and script scanning. It also disables Windows Defender real-time monitoring via PowerShell cmdlets, blocks Task Manager through registry modification, and disables critical keyboard shortcuts including Alt, F4, Windows key, and Tab to prevent the user from accessing system controls.

The encryption routine uses the Salsa20 stream cipher with random 8-byte values generated per file as encryption keys. GIBCRYPTO loads entire files into RAM, encrypts them in-place, writes the encrypted version with a .gibcrypto extension, and deletes the original file. This approach means larger files consume significant memory during encryption.

What makes GIBCRYPTO particularly dangerous is its destructive post-encryption behavior. After encrypting user files, the malware corrupts the Master Boot Record (MBR), rendering the system unbootable. It also randomly overwrites system DLL files with random bytes at 5-second intervals, progressively degrading system stability. Additionally, it deletes shadow copies via cmd.exe to eliminate any possibility of system restore. These destructive capabilities effectively make GIBCRYPTO a wiper-ransomware hybrid — even if a victim pays the ransom, system recovery is extremely unlikely due to MBR corruption and DLL destruction.

The malware establishes persistence through Windows Registry Run keys to survive system reboots. For command and control, GIBCRYPTO uses the Telegram Bot API, exfiltrating victim data including usernames, machine names, and system screenshots to a Telegram channel controlled by the attacker. The critical infrastructure link is that GIBCRYPTO uses the identical Telegram bot token (8514918049:AAEyTqSuSZaPOdNZN08tL395l0SgCFg-ju8) and chat ID (7592909148) previously associated with Snake Keylogger campaigns, strongly suggesting a common threat actor or shared tooling between the two malware families.

Snake Keylogger (also known as 404 Keylogger) is a well-documented .NET-based credential stealer that has been responsible for over 280 million blocked infection attempts globally, typically spreading through phishing emails and using AutoIt-compiled binaries with process hollowing into RegSvcs.exe for evasion. The shared Telegram infrastructure indicates either a single operator deploying both tools or a shared malware-as-a-service backend.

The zeroed PE timestamp in the GIBCRYPTO binary is a deliberate anti-forensics technique to hinder timeline reconstruction. The combination of encryption, destruction, and espionage capabilities in a single payload, coupled with shared C2 infrastructure with a known infostealer, represents a significant escalation in ransomware sophistication.

---

**Revalidated on 2026-03-12**

No substantive changes warranted to the description at this time. The existing description accurately covers: (1) the .NET PE implementation, (2) Salsa20 encryption with random 8-byte nonces, (3) the AMSI bypass mechanism with correct opcodes, (4) MBR corruption and system DLL destruction wiper behavior, (5) the shared Telegram bot C2 with Snake Keylogger, and (6) defense evasion techniques. The only potential future addition would be if independent vendor analysis surfaces new technical details about the encryption key derivation, additional C2 channels, or lateral movement capabilities not covered in the K7 Labs report.