After the fierce attack from WannaCry Ransomware GandCrab is currently raging in Vietnam and around the world. Companies and businesses are having a lot of headaches because all data is encrypted and there is no decryption. The IT Managers only have to submit A4 papers to apply for a job. Most ransomware infects via Remote Desktop by detecting Passwords. Even if you have the latest anti-virus software installed, you will still be infected as usual.

The owner of the GandCrab recently announced an end to the Ransomware-as-a-Service (RaaS) activities of a criminal hacker group associated with organized crime that extort more than $2 billion. from the victims.

Facing that situation, Bitdefender has just announced the GandCrab Version 5.2 decryption tool. This is the latest Version that can decrypt all versions of Ransomware GandCrab.

GandCrab Ransomware Version Decrypted

The good news for computer users who are victims of GandCrab, the new decryption tool released by BitDefender, can now unlock files encrypted by the latest versions of the GandCrab v5.2 Ransomware, as well as for older GandCrab ransomware versions. An updated version of the GandCrab ransomware decryption tool could allow millions of affected users to unlock their encrypted files for free without paying a ransom to cybercriminals.

The list below includes decoding variants of the GandCrab Ransomware. You need to determine the exact file extension to know which Version you are encrypted in.

Version 1:	extension: .GDCB.	Start with —= GANDCRAB ==, …………. extension: .GDCB
Version 2:	extension: .GDCB.	Start with —= GANDCRAB ==, …………. extension: .GDCB
Version 3:	extension: .CRAB.	Start with —= GANDCRAB V3 == ………….. extension: .CRAB
Version 4:	extension: .KRAB.	Start with —= GANDCRAB V4 == ………….. extension: .KRAB
Version 5:	extension: .([A-Z]+).	Start with —= GANDCRAB V5.0 == …………. extension: .UKCZA
Version 5.0.1:	extension: .([A-Z]+).	Start with —= GANDCRAB V5.0.1 == … …. extension: .YIAQDG
Version 5.0.2:	extension: .([A-Z]+).	Start with —= GANDCRAB V5.0.2 == …. extension: .CQXGPMKNR
Version 5.0.3:	extension: .([A-Z]+).	Start with —= GANDCRAB V5.0.3 == … …. extension: .HHFEHIOL
Version 5.0.3:	extension: .([A-Z]+).	Start with —= GANDCRAB V5.0.4 == … …. extension: .BYACZCZI
Version 5.0.5:	extension: .([A-Z]+).	Start with —= GANDCRAB V5.0.5 == … …. extension: .KZZXVWMLI
Version 5.0.5:	extension: .([A-Z]+).	Start with —= GANDCRAB V5.1 == … …. extension: .IJDHRQJD
Version 5.0.6 – 5.2	extension: .([A-Z]+).	Start with —= GANDCRAB V5.1 == … …. extension: .IJDHRQJD

Note when using GANDCRAB Ransomware Virus Decryption Tool

Computer infected with Virus must connect to the Internet. The decryption servers will attempt to reply to the sent ID with a possibly valid RSA-2048 private key. Only if this step is successful, the GandCrab Ransomware decryption process will continue.

Ransom notice. For this recovery solution to work, you must have at least (1) copy of the ransom notice on your PC. Note the ransom is required to recover the decryption key, as it is used to compute the unique decryption key for your data. Friend impossible run the cleanup utility to detect and remove the ransom note before executing this tool.

How to decode Ransomware Ransomware Virus GandCrab 5.2

Step 1: Download Ransomware decryption tool GandCrab to your computer.Note that this tool requires an active internet connection. Without the Internet, the decryption process will not continue.

Step 2: Run BDGandCrabDecryptor.exe.

Step 3: Agree to the terms and conditions.

Step 4: Select “Scan Entire System” if you want to search all encrypted data. Or just add the path to the encrypted file. You should choose “Backup files”. Then choose Scan.

Regardless of whether you choose Backup File or not, the decryption tool will attempt to decrypt the first 5 files in the provided path and will ARE NOT continue if decryption fails.

Step 5: Now, the data has been decrypted. If you have selected the Backup File option, you will see both the encrypted file and the decrypted file. You should verify whether the decrypted data can be opened, by opening the data.

In addition, you can refer to the decryption tools of other Ransomeware at: https://www.nomoreransom.org/en/decryption-tools.html