Grandcrab

Overview

Ransomware:Win32/GandCrab (often detected as GrandCrab) is one of the most historically significant Ransomware-as-a-Service (RaaS) operations to ever exist. Active primarily from early 2018 to mid-2019, the GandCrab operators claimed to have extorted over $2 billion before formally announcing their 'retirement.' GandCrab pioneered the highly structured, affiliate-based RaaS business model, where core developers maintained the malware and payment portals, while 'affiliates' were responsible for breaching networks (`T1190`) and deploying the payload in exchange for a percentage of the ransom (`T1486`).

Understanding GandCrab (The Rise of RaaS)
To an infected organization, GandCrab was devastating, encrypting servers and demanding payment via Dash or Bitcoin on a Tor-hosted portal. For threat intelligence analysts, GandCrab represents the industrialization of ransomware. When the operators 'retired', the affiliate network did not vanish; highly credible evidence suggests the core team and top affiliates immediately transitioned to form the notorious REvil (Sodinokibi) cartel.

Execution and Evasion Mechanics
Because GandCrab relied on affiliates, the initial access vectors varied wildly: RDP brute-forcing (`T1133`), massive malspam campaigns (often using Emotet or Trickbot loaders) (`T1566.001`), and exploit kits (like RIG and GrandSoft). Once on a network, affiliates utilized tools like Cobalt Strike and BloodHound for lateral movement. The GandCrab executable itself utilized custom packing and 'process hollowing' (`T1055.012`) to evade AV. It terminated database and backup processes (`T1490`) before using Salsa20 and RSA-2048 to encrypt files, appending extensions like `.GDCB`, `.CRAB`, or a randomized string depending on the version.

Indicators of Compromise & Impact
The impact was catastrophic data loss and severe business interruption. Host-based IoCs include files appended with the GandCrab extensions, the presence of ransom notes (e.g., `GANDCRAB-DECRYPT.txt`), and the execution of commands designed to delete Volume Shadow Copies (`vssadmin.exe delete shadows /all /quiet`). Network IoCs include connections to known GandCrab Tor domains via the Tor proxy network for payment negotiation.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_GRANDCRAB {
    meta:
        description = "Detects Grandcrab (ransomware)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "grandcrab" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Grandcrab Activity
id: f394290cdc74df7662caef0a7e2fa167
status: experimental
description: Detects generic indicators of the grandcrab malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*grandcrab*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Immediately isolate infected hosts to prevent lateral movement and the encryption of network shares.
2. Determine the specific version of GandCrab; free decryptors developed by Bitdefender and Europol (NoMoreRansom) are available for versions 1, 4, and 5 through 5.2.
3. Conduct a full forensic investigation to determine the affiliate's entry point (e.g., compromised RDP, phishing) to prevent re-infection.
4. Restore data from offline, immutable backups if a free decryptor is unavailable or fails.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not pay the ransom; the operators are formally 'retired', and paying funds organized crime. Use the free decryptors.
2. Avoid restoring backups without first identifying and closing the initial access vector used by the affiliate.

References & External Analysis

• Search "grandcrab" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: ransomware)

Explore other malware families in the same category:

• Pipo
• Sperolz
• Bruhorn
• Donn
• Gatak

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/grandcrab.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.