Related blog content
GandCrab ransomware distributed by RIG and GrandSoft exploit kits
Ransom.GandCrab is Malwarebytes’ detection name for a family of ransomware that encrypts important files and asks for a ransom to decrypt them. There are several versions of Ransom.GandCrab as the threat actors keep working on it. They all target Windows systems.
The first thing users of affected systems notice is usually the ransom note when the encryption has altready finished.
Ransom.GandCrab scans the infected system and any network shares for files to encrypt. You can recognize the version of GandCrab by looking at the extensions the encrypted files have:
Ransom.GandCrab is spread in many different ways:
For some versions of Ransom.GandCrab there are free decryption tools. You can check the NoMoreRansom! for which ones they are currently available.
Malwarebytes protects users from Ransom.GandCrab by using real-time protection.
and Malwarebytes protects users from Ransom.GandCrab by using Anti-Ransomware technology.
Malwarebytes can detect and remove Ransom.GandCrab on business machines without further user interaction.
To remove Ransom.GandCrab using Malwarebytes business products, follow the instructions below.
If you have infected machines that are not registered endpoints in Malwarebytes Endpoint Protection, you can remove Ransom.GandCrab with our Breach Remediation tool (MBBR).
Use the “rollback files encrypted by ransomware” option in Malwarebytes Endpoint Protection and Response if the infection was caught after it had encrypted some files. This may be the case if the infection was not caught by the Real-Time-Protection module, but by the behavioral based Anti-Ransomware Technology.
Malwarebytes can detect and remove Ransom.GandCrab without further user interaction.
Take note, however, that removing this ransomware does not decrypt your files. You can only get your files back from backups you made before the infection happened.
Select your language