DEV Community

jordanricky1604-ship-it
jordanricky1604-ship-it

Posted on • Originally published at jordanricky1604-ship-it.github.io

Malware Deep Dive: Gandcrab

#cybersecurity #malware #security #infosec

Deep Dive: Gandcrab (Ransomware)

Today we are analyzing the Gandcrab malware family, which falls under the Ransomware category.

Overview

GandCrab is ransomware that encrypts a victim's files and demands ransom for their return, targeting Windows PCs of both consumers and businesses. Per Malwarebytes, it launched in January 2018 and operated as a ransomware-as-a-service, with affiliates spreading it for a share of the profits. On May 31, 2019 its operators publicly announced they were shutting down. Free decryptors for certain versions were later released through industry and law-enforcement collaboration.

Known Aliases

Security vendors and researchers may refer to this family by several different names, including:

  • GandCrab

MITRE ATT&CK Techniques

This family has been observed utilizing the following techniques:

Frequently Asked Questions

What is GandCrab?
Ransomware that encrypts files on Windows PCs and demands payment; it targeted both consumers and businesses.

When was GandCrab active?
It launched in January 2018 and its operators announced a shutdown on May 31, 2019.

How was GandCrab distributed?
As a ransomware-as-a-service: affiliates spread it through methods like exploit kits, phishing, and other vectors in exchange for a cut of the ransoms.

Is there a free GandCrab decryptor?
Free decryptors for certain GandCrab versions were released through industry and law-enforcement collaboration; availability depends on the version.

Should I pay the GandCrab ransom?
Security guidance generally discourages paying. Check whether a free decryptor exists for your version (e.g., via the No More Ransom project) and restore from clean backups where possible.

How can I protect against ransomware like GandCrab?
Keep software patched, be cautious with email attachments and links, use reputable security software, and maintain tested offline backups.

Where can I read an authoritative source on GandCrab?
Malwarebytes maintains a GandCrab overview, linked on this page.

This article is part of the Malware Families Catalog. Visit the original page for more details and interactive data! You can also find the full dataset on Hugging Face and Kaggle.

Top comments (0)