{
  "family": "grandcrap",
  "sample_count": 1,
  "category": "ransomware",
  "description": "<h3>Executive Summary</h3>\nGrandcrap (often a detection alias or misspelling of the highly notorious <strong>GandCrab</strong> ransomware family) represents a severe Ransomware-as-a-Service (RaaS) threat. GandCrab/Grandcrap operators specialize in infiltrating corporate networks, encrypting critical business data with strong cryptographic algorithms (typically RSA-2048 and AES-256), and demanding significant cryptocurrency ransoms in exchange for the decryption keys.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nAs a RaaS operation, distribution methods vary wildly based on the specific \"affiliate\" deploying it. Common vectors include highly targeted spear-phishing campaigns, the exploitation of vulnerable internet-facing services (like unpatched RDP or VPN gateways), and the utilization of exploit kits (such as RIG EK).\n\nUpon execution, Grandcrap focuses on rapid, total data denial:\n<ul>\n<li><strong>Shadow Copy Deletion:</strong> The ransomware immediately executes `vssadmin.exe Delete Shadows /All /Quiet` and utilizes WMIC to destroy Windows Volume Shadow Copies, preventing trivial file restoration.</li>\n<li><strong>Rapid Encryption:</strong> Grandcrap scans all local drives, mapped network shares, and connected removable media. It encrypts user files (documents, databases, images) while intentionally avoiding critical system files to ensure the OS remains stable enough to display the ransom note.</li>\n<li><strong>Extortion:</strong> It drops ransom notes (often named `[random]-DECRYPT.txt`) in every encrypted directory and frequently changes the desktop wallpaper to instruct the victim to access a Tor-based payment portal to negotiate the ransom.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Grandcrap ransomware infection is a \"Code Red\" security crisis. It results in immediate, widespread disruption of business operations. If backups are not properly segmented and are also encrypted, the incident can lead to catastrophic data loss and massive financial impact.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Network Severance:</strong> Isolate all infected endpoints and servers instantly. The encryption process can spread rapidly across network shares. Do NOT simply reboot the machines, as this may trigger further malicious routines or destroy volatile memory forensics.</li>\n<li><strong>Engage Incident Response:</strong> Activate the corporate Incident Response plan. Preserve a forensic image of the encrypted machines before attempting any restoration.</li>\n<li><strong>Restore from Immutable Backups:</strong> Do not pay the ransom unless absolutely necessary (and after consulting legal counsel). The primary recovery method must be a complete bare-metal wipe of the infected infrastructure followed by restoration from offline, immutable, and verified backups.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Ransomware.GandCrab",
    "Ransom.Grandcrap",
    "Win32/GandCrab"
  ],
  "enrichment_level": "insufficient_information",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1486",
    "T1490",
    "T1059",
    "T1204.002"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-01T17:44:33Z",
  "type": "Ransomware",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}