Researchers have released a free decryption tool of GandCrab ransomware which allows victims to decrypt their files for free
Researchers have released a free decryption tool of GandCrab ransomware which allows victims to decrypt their files for free.The free decryption tool was developed by Security researchers from Bitdefender along with several law enforcement organizations including FBI, Romanian police and other countries such as Bulgaria, France, Hungary, Italy, Poland, the Netherlands, United Kingdom.This version decryption tool can be used to recover files from GandCrab ransomware versions 1, 4 and 5.Victims can recognize the version of ransomware by extension it appends to encrypted files and or ransom note.Below is the table which shows GandCrab ransomware versions and extension it appends:
| Version | Extension | Ransom Note |
| Version 1 | file extension is .GDCB. | The ransom note starts with —= GANDCRAB =—, ……………. the extension: .GDCB |
| Version 2 | file extension is .GDCB. | The ransom note starts with —= GANDCRAB =—, ……………. the extension: .GDCB |
| Version 3 | file extension is .CRAB. | The ransom note starts with —= GANDCRAB V3 =— ……….. the extension: .CRAB |
| Version 4 | file extension is .KRAB. | The ransom note starts with —= GANDCRAB V4 =— ……….. the extension: .KRAB |
| Version 5 | file extension is .([A-Z]+). | The ransom note starts with —= GANDCRAB V5.0 =— ………. the extension: .UKCZA |
| Version 5.0.1 | file extension is .([A-Z]+). | The ransom note starts with —= GANDCRAB V5.0.2 =— …. the extension: .YIAQDG |
| Version 5.0.2 | file extension is .([A-Z]+) | The ransom note starts with—= GANDCRAB V5.0.2 =— …. the extension: .CQXGPMKNR |
| Version 5.0.3: | file extension is .([A-Z]+). | The ransom note starts with—= GANDCRAB V5.0.2 =— …. the extension: .HHFEHIOL |
You may be interested in reading:New FilesLocker Ransomware Discovered Distributing as a Ransomware as a Service