GandCrab Ransomware Recovery, Payment & Decryption Statistics

GandCrab ransomware payments are typically lower than the ransomware marketplace average. This is due to TOR payment collection site that automates a great deal of the hacker’s own costs. GandCrab also affects more small companies and individuals that have less capacity to pay.

GandCrab incidents are much shorter than other types of ransomware due to the automated TOR site used for payment collection and decrypter tool delivery. Read more about how to recovery and use the GandCrab decrypter tool here.

GandCrab Ransomware has a high success rate after a ransom payment is made. Relative to other types of ransomware, the decryptor tool is relatively straight forward to use.

Immediate gandcrab Ransomware Help

Due to the drag-net nature of GandGrab ransomware, infections are typically less targeted. Recovery efforts are usually less time consuming than average and data recovery rates are also high, ~98%.

For immediate assistance contact us or call 24/7 Support: (203) 442-4050

gandcrab RANSOMWARE FREQUENTLY ASKED QUESTIONS

UPDATE: Versions 1, 4, and some versions of 5 have a free decryption tool available from Bitdefender. Version 5.2 is currently the main version in the wild and does not have a free decryptor.

Some active GandCrab ransomware variants can not be decrypted by any free tool or software. If you submit a file example to us, we will have a look for free and let you know. There are also good free websites that you can upload a sample file to and independently check. You should NOT pay a data recovery firm or any other service provider to research your file encryption. They will use the same free resources noted above…so don’t waste your money or time!

Most GandCrab ransomware is laid directly by a hacker that has accessed an unprotected RDP port, utilized email phishing to remote into a network via an employee’s computer, or utilized malicious attachments, downloads, application patch exploits or vulnerabilities to gain access to a network.

.Crab or more recently with GandCrab V5, files have a random 5 character extension added:

file name.[XYXYX]

The ransom notice will be a .txt file named

file name.[XYXYX-DECRYPT].txt 

Do not lose this file once you find it!

GandCrab ransomware hackers will leave a -manual.txt file notice behind that will be prominent and easy to find. It commonly looks like like the image below. It includes a TOR site to visit for instructions.

Note: We do not advise that any person or company contact a hacker and negotiate directly. Cyber criminals can be difficult to communicate with. Let a professional assist you.

RANSOMWARE FREQUENTLY ASKED QUESTIONS

You will need to provide information from both the ransom notice and a sample encrypted file. We will schedule a call to discuss the severity of the attack, the operability of your company and the likely timeline / cost of recovering from the attack. You will also need to provide identifying information on your company, and an authorized representative of your company.

You are already being extorted; we don’t think you deserve to pay another large fee. Coveware charges flat per incident fees. Whether the case lasts one week or three weeks, our fees are flat. We do not charge spreads of fees tied to the size of the ransom amount. Our fees will never be even close to the amount of the ransom demanded by the cyber criminal, and you should be skeptical of why any other service provider would charge a fee that high.

You should be extremely skeptical of any data recovery firm that claims they can decrypt ransomware. Typically they are just paying the cyber criminal without your knowledge and pocketing the difference between the ransom amount and what they will charge you. Know the facts before you engage. If the ransomware IS decryptable, the tool can be found for free. If not, purchasing a key from the cyber criminal is the only way to unlock your files. While Coveware does not condone paying cyber criminals, we recognize it is often the only choice if backups are not available or have become compromised as well. If that is the case, you deserve an honest, transparent experience.

There is no guarantee that paying the ransom will result in a working decryption tool being delivered. However, Coveware believes that data aggregation can help customers make the most informed data-driven decisions. Since we handle lots of cases of the same ransomware types, we are able to share our experiences and help customers decide how to proceed.

If the ransomware payment is successful, a decryption tool & key is provided by the hacker that can be used to manually decrypt your files.

There are some common security mis-configurations that lead to a ransomware attack. We can share some tips and resources for preventing future attacks, but encourage companies to perform a full forensic review or security assessment as soon as possible. Consistent investment in security IT is the best antidote to preventing future attacks.

WHY CHOOSE COVEWARE RANSOMWARE RECOVERY SERVICES?

FREE
RANSOMWARE ASSESSMENT

Provide a few details from the ransom notice, an example encrypted file and details of the operability of your company and budget/time. We will provide context into the severity of the attack and your options for decryption and recovery using our database of similar cases.

• Identify Ransomware Type

• Find free Decryptor tools

• Identify Threat Actor Group
  

24x7 SUPPORT
- RANSOMWARE INCIDENT RESPONSE

We have deep experience communicating and negotiating with hackers. It’s what we do all day long! Take advantage of our experience and allow us to shoulder this burden.

• Secure & safe negotiations

• Proactive service

• Transparent communications

• Determine Risks & Outcomes
  

FILE DECRYPTION
& RECOVERY SUPPORT

Coveware has access to a ready supply of any crypto currency, and offers a 15 minute disbursement service level agreement. We also support the decryption/data recovery process.

• Professional IT support

• Insurance documentation

• Post-incident follow up

• Post-incident support