Ransom.GandCrab
ThreatDown is now the name of the Malwarebytes line of business products. References to Malwarebytes below reflect the amazing technology used to first identify the threat.
Short bio
Ransom.GandCrab is Malwarebytes’ detection name for a family of ransomware that encrypts important files and asks for a ransom to decrypt them. There are several versions of Ransom.GandCrab as the threat actors keep working on it. They all target Windows systems.
Type of infection
Ransom.GandCrab scans the infected system and any network shares for files to encrypt. You can recognize the version of GandCrab by looking at the extensions the encrypted files have:
- Version 1 gives the .gdcb extension
- Version 2 and 3 give the .crab extension
- Version 4 gives the .krab extension
- Version 5 gives a randomized 5 letter extension
Ransom.GandCrab is spread in many different ways:
- malspam
- exploit kits
- social engineering
- fake cracked software sites
Malicious behavior
The first thing users of affected systems notice is usually the ransom note when the encryption has altready finished.
Aftermath
For some versions of Ransom.GandCrab there are free decryption tools. You can check the NoMoreRansom! for which ones they are currently available.
Protection
Malwarebytes protects users from Ransom.GandCrab by using real-time protection.
and Malwarebytes protects users from Ransom.GandCrab by using Anti-Ransomware technology.
Business remediation
Malwarebytes can detect and remove Ransom.GandCrab on business machines without further user interaction. To remove Ransom.GandCrab using Malwarebytes business products, follow the instructions below.
Home remediation
Malwarebytes can detect and remove Ransom.GandCrab without further user interaction.
- Please download Malwarebytes to your desktop.
- Double-click MBSetup.exe and follow the prompts to install the program.
- When your Malwarebytes for Windows installation completes, the program opens to the Welcome to Malwarebytes screen.
- Click on the Get started button.
- Click Scan to start a Threat Scan.
- Click Quarantine to remove the found threats.
- Reboot the system if prompted to complete the removal process.
Take note, however, that removing this ransomware does not decrypt your files. You can only get your files back from backups you made before the infection happened.