Gandcrypt
Overview
Executive Summary
GandCrypt (universally known as GandCrab) was one of the most prolific, destructive, and financially successful Ransomware-as-a-Service (RaaS) operations in history. First observed in January 2018, it quickly dominated the ransomware landscape, reportedly generating over $2 billion in extorted funds before its operators officially "retired" in mid-2019. It is characterized by its aggressive encryption, agile development cycles (evading security tools), and massive distribution networks.Infection Vector and Technical Capabilities
GandCrab affiliates utilized a massive array of distribution methods. It was heavily distributed via major exploit kits (RIG, GrandSoft) and vast malspam campaigns pushed by the Necurs botnet. It was also frequently deployed manually by attackers who purchased RDP access from Initial Access Brokers (IABs). Its technical execution was highly sophisticated:- Agile Evasion and Exploitation: GandCrab underwent constant revision (from v1.0 to v5.2). Later versions famously incorporated exploits for zero-day vulnerabilities (like CVE-2018-8120 for Windows privilege escalation) and actively terminated hundreds of specific antivirus and database processes before encrypting.
- Aggressive Encryption: It utilized a combination of RSA and Salsa20/AES algorithms to rapidly encrypt local files and all accessible mapped network shares. It appended various extensions to encrypted files, famously including `.GDCB`, `.CRAB`, and eventually randomized extensions.
- Ransom Note and Payment: It dropped a highly recognizable ransom note (`GANDCRAB-DECRYPT.txt`) demanding payment in Dash (a privacy coin) or Bitcoin via a Tor-hosted payment portal, threatening permanent data loss if the timer expired.
Threat Assessment
A GandCrab infection is a catastrophic event resulting in immediate, massive data loss and operational downtime. While the original GandCrab operation claims to be defunct, its affiliates and tactics have migrated to modern RaaS syndicates (like REvil/Sodinokibi), and legacy or copycat infections remain a threat.Incident Response and Remediation
- Total Network Severance: If active encryption is detected, immediately pull the network cables from the infected machine(s) and critical file servers to halt the spread of the encryption across SMB shares.
- Check for Free Decryptors: Because the operation officially shut down, the operators released the master decryption keys. Cybersecurity firms (like Bitdefender via NoMoreRansom.org) provide *free* decryptors for almost all versions of GandCrab. **Do not pay the ransom.**
- Post-Incident Eradication: Even if data is successfully decrypted using free tools, the initial infection vector (e.g., an exposed RDP port or compromised credentials) remains open. The network must be forensically audited to close the vulnerability, and affected machines should be rebuilt from clean baselines.
Known aliases
Threat reports may refer to this family under multiple names:
MITRE ATT&CK Techniques
This family has been observed using the following ATT&CK techniques: T1486 T1490 T1068
Generated Detections (Boilerplate)
These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.
YARA Rule
rule MALWARE_WIN_GANDCRYPT {
meta:
description = "Detects Gandcrypt (ransomware)"
author = "SystemHelpdesk Boilerplate Generator"
date = "2026-07-06"
strings:
$s1 = "gandcrypt" ascii wide nocase
$s2 = "ransom.gandcrab" ascii wide nocase
$s3 = "win32/gandcrypt" ascii wide nocase
$s4 = "trojan-ransom.win32.gandcrypt" ascii wide nocase
condition:
uint16(0) == 0x5a4d and any of them
}Sigma Rule
title: Suspicious Gandcrypt Activity
id: c960ab4a684244f327b26e6cf54a62ca
status: experimental
description: Detects generic indicators of the gandcrypt malware family.
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith:
- '\cmd.exe'
- '\powershell.exe'
CommandLine|contains:
- "*gandcrypt*"
- "*ransom.gandcrab*"
- "*win32/gandcrypt*"
- "*trojan-ransom.win32.gandcrypt*"
condition: selection
level: mediumReferences & External Analysis
- Search "gandcrypt" on VirusTotal (External Analysis)
Frequently Asked Questions
Where can I learn more about gandcrypt?
Refer to the linked MITRE ATT&CK technique pages, which document the behaviors associated with this family.
How do I remove the Gandcrypt Ransomware from Windows?
Manual removal of Gandcrypt is highly discouraged as it may leave persistence mechanisms intact. We recommend disconnecting the device from the internet and utilizing a professional incident response service or enterprise-grade EDR software to conduct a full forensic sweep.
Is Gandcrypt a virus or a Ransomware?
Gandcrypt is classified as a Ransomware. Unlike traditional viruses that infect files, modern malware like Gandcrypt typically operates as a standalone payload designed to compromise systems, steal data, or deploy secondary stage implants.
What are the main symptoms of a Gandcrypt infection?
Symptoms of Gandcrypt can include unexpected system slowness, unauthorized outbound network traffic to unknown IP addresses, disabled security software, and suspicious background processes running from AppData or Temp directories.
Related Families (Category: ransomware)
Explore other malware families in the same category:
Protect Your Network Against Ransomwares
Want to prevent Gandcrypt and similar threats from compromising your organization? Read our comprehensive defensive guide: Ransomware Protection Guide.
Machine-readable
Get this profile as JSON: https://jordan123234-malware-families-explorer.static.hf.space/api/gandcrypt.json
Ecosystem & Interactive Environments
This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.