Gandcrab 5.0.1 ransomware (updated Feb 2019) - Decryption Methods Included

What is Gandcrab 5.0.1 ransomware?

Gandcrab 5.0.1 ransomware is a new version of the notorious GandCrab that changed the ransom note from .HTML to .TXT

Gandcrab 5.0.1 ransomware is a dangerous cyber threat that attacks large companies and demands ransom.

Gandcrab 5.0.1 is a ransomware virus that encrypts users' data and marks these files with a file extension consisting of five random letters. This cryptovirus belongs to GandCrab ransomware family and the 5th its version which appeared only a few days after. Just like the initial GandCrab v5, it performs the encryption process and marks encoded data with the help of Salsa and RSA encryption algorithms.^[1] The main change hackers did in this variant is the ransom note which switched from the HTML file to .txt file. The full name of the ransom note is [random_extension]-Decrypt.txt and it is placed on every folder on the system. Additionally, these ransomware developers choose the language according to the victim's operating system.

The main goal of Gandcrab 5.0.1 virus is to enter the system unnoticed and encrypt files in various formats. This data encryption victimizes the machine and marks files with the appendix that indicates about made changes. When this process ends successfully, hackers leave ransom note to inform a user about the cyber threat and possible actions.

The main and probably the only difference this particular version has in comparison with the previous variants is the type of ransom note file. Since the beginning, GandCrab had the ransom note displayed in HTML file and this virus that emerged at the end of September 2018 places [random_extension]-Decrypt.txt file as the ransom message for the victims.

Gandcrab 5.0.1 ransomware ransom note reads the following:

—= GANDCRAB V5.0.1 =—
Attention!
All your files, documents, photos, databases and other important files are encrypted and have the extension:
The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files.
The server with your key is in a closed network TOR. You can get there by the following ways:>
—————————————————————————————->
•Download Tor browser – https://www.torproject.org/
• Install Tor browser
• Open Tor Browser
• Open link in TOR browser: http://gandcrabmfe6mnef.onion/e499c8afc4ba3647
• Follow the instructions on this page
—————————————————————————————-
On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.
ATTENTION!
IN ORDER TO PREVENT DATA DAMAGE:
* DO NOT MODIFY ENCRYPTED FILES
* DO NOT CHANGE DATA BELOW

As various other crypto-demanding threats, Gandcrab 5.0.1 ransomware suggests using TOR^[2] browser for these users when paying the ransom. Malware creators often choose this because it is anonymous and private. Cybercriminals behind this cyber infection don't want to be identified.

However, you shouldn't think about contacting these people at all because there is no guarantee that communication between the victim and the hacker would end up well. This and paying the ransom, in general, can lead to permanent data and money loss.

You need to take into consideration that Gandcrab 5.0.1 is the member of the already dangerous crypto-demanding ransomware family. These people that create threats like this have one goal to extort money, and your data is not the thing they care about. Based on these facts, researchers^[3] advise, staying away from people who developed the virus.

You need to think about the data recovery yourself because there is little to none possibility that hackers are going to decrypt your encoded files or any decryption tool would be released in the meantime. Remove Gandcrab 5.0.1 ransomware from the system, clean the system further and then try to recover your data with clean files from the backup.

If you have no backups, you can try to perform Gandcrab 5.0.1 removal and then use data recovery software. We have a few suggestions down below. Also, we recommend using FortectIntego or other anti-malware tools from the list below for the whole virus elimination process.

Gandcrab 5.0.1 ransomware is a cryptovirus that emerged from the previous version in five days and changed the format of the ransom note.

GandCrab ransomware gets a decryption tool and updated features

When decryption tool for the GandCrab 5.0-5.0.3 ransomware was released,^[4] immediately after that, virus developers released a new version with additional distribution changes. Widely available exploit tools increased the distribution of this virus. Also, the new campaign revealed a feature of a few different IDs. When files get encrypted, usually, there is a one particular file extension added to all of them.

An updated version of the virus includes more animated, prank-like ransom note with cartoon pictures. The TOR site gives the impression that GandCrab 5.0.1 ransomware developers are not taking the attack on companies, everyday users, seriously.

GandCrab v5.0.1 ransomware distributes new versions via exploit kits and other malware infections.

Common ransomware spreading methods

Ransomware as one of the most dangerous cyber threats has this status for a reason. The most common way to spread this malware is infected spam email attachments which contain direct ransomware payload or other malware that is designed to spread cyber infections further.

Based on various victim comments, this particular version targets large companies and their networks. This fact makes the distribution method which relies on spam more useful as people working in these companies get a lot of emails every day.

This distribution method works silently because the minute user opens the insecure email and downloads that file attachment malicious script gets on the system and starts the job. However, there are a few other methods used in ransomware attacks. Previous version in this family also known as using exploit kits to spread the malware on the devices. Also, RDP can be used to install malware if unprotected.

Eliminate Gandcrab 5.0.1 ransomware and its' malicious components

Remember that ransomware is a notorious threat and can change various parts of your system if you decide to wait before terminating the virus. This process of Gandcrab 5.0.1 ransomware removal is difficult but crucial because you cannot use your device properly or restore files on the infected system ransomware immediately encodes additional data.

To remove Gandcrab 5.0.1 ransomware, you need to use tools like FortectIntego, SpyHunter 5Combo Cleaner or Malwarebytes to make sure that no malware remains on the system. You can use a few tools one after the other to double-check and remove all additional malware. When you carefully clean your device, restore your files by using backups. You can also restore them from the cloud or external device. However, if you don't have your encrypted files saved in a different location, use methods we provided below.