--- title: Evolution of GandCrab Ransomware description: GandCrab ransomware was discovered near the end of January 2018 as a part of Ransomware-as-a-Service (RaaS) and soon became the most popular and widespread ransomware of the year. The authors of this ransomware are very active and have released at least five versions of GandCrab to date. canonical_url: https://www.acronis.com/en/blog/posts/gandcrab/ locale: en last_updated: 2026-10-27 --- [Acronis Blog](https://www.acronis.com/en/blog/) # Evolution of GandCrab Ransomware GandCrab ransomware was discovered near the end of January 2018 as a part of Ransomware-as-a-Service (RaaS) and soon became the most popular and widespread ransomware of the year. By Ravikant Tiwari [Learn More](https://www.acronis.com/en/products/cyber-protect/) [![Image 2: Acronis Editorial Team](https://staticfiles.acronis.com/images/content/d85707ae91461544212d39836dc32b42.png)](https://www.acronis.com/en/blog/authors/acronis/ "Acronis Editorial Team") [Acronis Editorial Team](https://www.acronis.com/en/blog/authors/acronis/) 22 min read Last updated 17 August 2018 GandCrab ransomware was discovered near the end of January 2018 as a part of Ransomware-as-a-Service (RaaS) and soon became the most popular and widespread ransomware of the year. _**By Ravikant Tiwari**_ ![Image 3: GrandCrab Ransomware](https://staticfiles.acronis.com/images/content/b3e6d9fa1f7d93522cc5e59025b3bf99.png) GrandCrab Ransomware The authors of this [ransomware](https://www.acronis.com/en-us/ransomware-protection/) are very active and have released at least five versions of GandCrab to date. While there are no major differences between any two versions of this malware, the frequent changes show the time attackers are investing in maintaining and developing it. GandCrab is also the first ransomware that demands payment in DASH cryptocurrency and utilizes the **“.bit”**top level domain (TLD)**.**This TLD is not sanctioned by ICANN and it therefore provides an extra level of secrecy to the attackers. As we mentioned in our previous articles on [Black Ruby](https://www.acronis.com/en-us/blog/posts/black-ruby-combining-ransomware-and-coin-miner-malware) and [Data Keeper](https://www.acronis.com/en-us/articles/data-keeper/), ransomware is still the favorite choice among the attackers for making money. GandCrab certainly supports this argument. The plot line below shows a steep rise in number of GandCrab samples on weekly basis since its inception, which has been quite massive. ![Image 4: Number of GandCrab samples by week](https://staticfiles.acronis.com/images/content/bfcd18081c97235c86e2bfafe8da177c.png) Number of GandCrab samples by week _Figure 1: Number of GandCrab samples by week_ GandCrab experienced initial setbacks when the anti-virus company Bitdefender released a decrypter for the earlier versions of GandCrab (v1.0 and v1.1). The decrypter was made possible not by exploiting any flaws in the encryption process, but rather because the web server used to hold user data got compromised and all the private keys were leaked. That provided an opportunity for some lucky victims who were infected during that short window to get their files back without having to pay any ransom. The hack was confirmed by the ransomware author, but GandCrab 2.0 was released the same week and the server was hardened against any future attacks. ![Image 5: Ransomware author confirms the hack](https://staticfiles.acronis.com/images/content/3e885c4fb86a156b3f38405430e6ae73.png) Ransomware author confirms the hack _Figure 2: Ransomware author confirms the hack_ ## Spreading Mechanism GandCrab is distributed via multiple spreading vectors, which include spam emails, exploit kits and other affiliated malware campaigns. GrandSoft and RIG are the two most commonly used exploit kits for distributing GandCrab along with the high number of malicious spam emails. These spam emails trick users into opening the file contained inside the attached ZIP archive, which is generally a script that downloads GandCrab ransomware and executes it. ![Image 6: Spam email distributing GandCrab](https://staticfiles.acronis.com/images/content/96aa1bab48ebeb932762336bd429e5f7.png) Spam email distributing GandCrab _Figure 3: Spam email distributing GandCrab_ The JavaScript file is highly obscured. Upon execution, it decodes a URL where GandCrab is hosted. The script then downloads the malware to a file on the disk and executes it. ![Image 7: JavaScript downloading GandCrab](https://staticfiles.acronis.com/images/content/ea1cc0089b581c2762d7cc8a240e4cdf.png) JavaScript downloading GandCrab _Figure 4: JavaScript downloading_ _GandCrab_ The above URL seems to be hosted on a benign Chinese server that was probably compromised by the attackers and now is being used for distributing GandCrab ransomware binaries. ![Image 8: IP information](https://staticfiles.acronis.com/images/content/78c8e93d0f869631886b650e166a897f.png) IP information _Figure 5: IP information_ The network of GandCrab is quite complicated and relates to other Trojan Downloader malwares, which shows a kind of affiliation between GandCrab and other malware. ![Image 9: Other malware, URLs and DNS servers related to GandCrab](https://staticfiles.acronis.com/images/content/a485f369445fe13030fb0c7155229688.png) Other malware, URLs and DNS servers related to GandCrab _Figure 6: Other malware, URLs and DNS servers related to_ _GandCrab_ ## Technical Analysis We will look into the latest version of GandCrab ransomware v2.3.1 having MD5: 4302AAC62E41F4355206D49257C3AAAE, which was distributed using the Flash RIG exploit kit. The file has a compilation date of April 9, 2018 according to the PE header. ![Image 10: PE header timestamp](https://staticfiles.acronis.com/images/content/4e297e65b29e5627f350f57d1e250db8.png) PE header timestamp _Figure 7: PE header timestamp_ The executable file is custom packed, which unpacks as a DLL with the internal name _“encryption.dll”_ and uses a reflective DLL loading technique to load it into memory. The execution begins at _DllEntryPoint_, which is automatically call on by the system as soon as the DLL is loaded. (This reflective DLL loading technique is used in the recent version starting from v.2.0. Older versions of GandCrab v1.0 and v.1.1 simply unpack and execute from a newly allocated memory page with read-write and execute permission, which is not backed by any DLL.) GandCrab starts with reconnaissance activity and collects the following information from the victim’s machine: * User name * PC name * Domain name * Locale information * Keyboard layout * Operating system name * Operating system type * Installed anti-virus software(s) * Processor name and identifiers * Drive types * Available space on hard drives * Public IP address. During this reconnaissance, if GandCrab identifies a keyboard layout to be RUSSIAN it will terminate the execution immediately. GandCrab generates a unique **Ransom-ID** for each victim by calculating a CRC32 hash of the string formed by concatenating the volume serial number, processor name and processor identifier. ![Image 11: String for calculating CRC32 hash as RANSOM-ID](https://staticfiles.acronis.com/images/content/202395e4cd60d7f785fff5938280be43.png) String for calculating CRC32 hash as RANSOM-ID _Figure 8: String for calculating CRC32 hash as RANSOM-ID_ The computer domain name and Ransom-ID are used to create a named mutex that ensures only single instance of the ransomware is running at any given time. ![Image 12: Mutex name](https://staticfiles.acronis.com/images/content/436ddeb5cad295b621bb92766ae94c6c.png) Mutex name _Figure 9: Mutex name_ After the reconnaissance, initial checks, and mutual exclusion are complete, GandCrab copies itself to the “_%APPDATA%/Microsoft”_ location with a random name and maintains one-time persistence. Before doing this, it again looks for presence of specific AV device drivers belonging to Kaspersky, F-Secure, Symantec Auto Protect, and Symantec AV engine. If none are found, then it copies itself to the “_%APPDATA%/Microsoft”_ location. The presence of Kaspersky device drivers is handled differently. The presence of following device drivers are verified: * **klif.sys** – Kaspersky Anti-Virus * **kl1.sys** – Kaspersky Anti-Virus * **fsdfw.sys** – F-Secure Anti-Virus Internet Shield * **srtsp64.sys** - Symantec Auto Protect * **srtsp.sys** - Symantec Auto Protect * **NavEx15.sys** - Symantec AV engine * **NavEng.sys** - Symantec AV engine It adds an entry of the copied file path for GandCrab executable to the RunOnce key of HKEY_CURRENT_USER as a one-time persistence mechanism. ![Image 13: RunOnce key set to GandCrab executable](https://staticfiles.acronis.com/images/content/a41c1c1fc525b34d69c506ced9954dbc.png) RunOnce key set to GandCrab executable _Figure 10: RunOnce key set to_ _GandCrab_ _executable_ The next step is to terminate all processes that may have locked handles for certain files that GandCrab wishes to encrypt. Mostly these processes fall under one of the following categories: * Document editors/viewers (office files, PDF files, images, text files etc.) * Databases applications * Email clients * Game engines * Web browsers ![Image 14: List of process name GandCrab terminates](https://staticfiles.acronis.com/images/content/d62fab122e775988962a4f5fde016b8e.png) List of process name GandCrab terminates _Figure 11: List of process name GandCrab terminates_ GandCrab then decrypts the ransom note stored within the binary using simple XOR encryption. The XOR key is set to 0x5, which has not changed since the earlier version of this ransomware. The ransom note has a placeholder/marker _“{USERID}”_ which gets substituted with the value of the Ransom-ID that was generated in the earlier stage. ![Image 15: Code to decrypt and prepare personalized ransom note](https://staticfiles.acronis.com/images/content/1ea268f80bd25c548aa6419b363883c7.png) Code to decrypt and prepare personalized ransom note _Figure 12: Code to decrypt and prepare personalized ransom note_ ![Image 16: {USERID} placeholder substituted with user specific Ransom-ID](https://staticfiles.acronis.com/images/content/f136c46fc941ddedb120d98315e6c0d4.png) {USERID} placeholder substituted with user specific Ransom-ID _Figure 13: {USERID} placeholder substituted with_ _user specific_ _Ransom-ID_ ## Key Generation ### RSA keys GandCrab generates an ephemeral RSA 2048-bit key pair on each victim machine that will later be used to encrypt the AES 256-bit key and IV (initialization vector), which are used to encrypt user files. Separate AES keys are generated for each user files and are appended to the same file in an encrypted form. The RSA key pair is converted to base64 format, which is then added with other information collected from the victim machine. That gets encrypted with RC4 encryption using a pseudo random key, generated based on _GetTickCount_() and is sent to the server. The RC4 key is used as object name to open a new HTTP request handle for connecting to GandCrab’s control server. ![Image 17: Code to generate RSA key pair](https://staticfiles.acronis.com/images/content/2283276b4389ea6200156d4c672b1b02.png) Code to generate RSA key pair _Figure 14: Code to generate RSA key pair_ In the above code snippet, _CryptGenKey()_ is called with algorithm Id _CALG\_RSA\_KEYX_ for generating RSA key pair and a flag is set to 0x8000001, where upper 16 bits of 0x8000001 is 0x800, or decimal 2,048 for specifying the key length to be 2048 bit. If the function does not succeed in generating the RSA key, GandCrab tries to restart itself with elevated privileges. GandCrab has implemented a routine to run commands with elevated privileges. To do this it begins by checking the WNDOWS version. If it’s above XP, then it verifies the SID membership of the current process to check if it belongs to an administrator group. If not, it uses _ShellExecuteExW()_ API with the verb “runas” and file to run “C:\\Windows\\System32\\wmic.exe”, to which it passes the parameter “process call create ‘cmd /c start ’”. Here the function parameter is the full path of the current executable. The complete command to execute with “runas” is **_C:\Windows\System32\wmic.exe process call create "cmd /c start "_** Below is an example of the executing notepad.exe: ![Image 18: Command to execute notepad.exe](https://staticfiles.acronis.com/images/content/7752e936bdd4ce7715be10be26f33808.png) Command to execute notepad.exe _Figure 15: Command to execute notepad.exe_ ![Image 19: Run with elevated privileges](https://staticfiles.acronis.com/images/content/aedcbc95826a12bda33d081398a2822f.png) Run with elevated privileges _Figure 16: Run with elevated privileges_ ![Image 20: Implementation of RunWithElevatedPriv function](https://staticfiles.acronis.com/images/content/2e74fc63440297d3d47726991220343a.png) Implementation of RunWithElevatedPriv function _Figure 17: Implementation of RunWithElevatedPriv function_ **Filed** **Value** **action** call **pc_user** {redacted} **pc_name** DESKTOP-S{redacted} **pc_group** WORKGROUP **pc_lang** en-US **pc_keyb** 0 **os_major** Windows 10 {redacted} **os_bit** x86 **ransom_id** 1ca7f{redacted}1ecb **hdd** C:FIXED_3383{redacted}120/122{redacted}656 **id** 30 **subid** 35 **pub_key** BgIAAACkAABAAgAAAEAAQB3s09QKVE3c4…{redacted} Base64 encoded RSA public key **priv_key** BwIAAACkEyAAgAAOZPAFOlLA609QKVE3c4g5Gj…{redacted} Base64 encoded RSA private key **version** 2.3.1 _Figure 18: Data sent to command and control server in RC4 encrypted form before file encryption begins_ ### RC4 keys RC4 key is generated by concatenating the string _“**europol**”_ with a CRC32 hash of randomly generated string based on the _GetTickCount()_ function and some hardcode character arrays. This randomly generated string is then sent to the server in order to enable decryption of the private RSA key, which is necessary for ultimate decryption of the user files. GandCrab’s authors seem to reference every person or organization that may have acted against them or that they are concerned about. They have purposefully used strings like "fabian wosar <3", “europol”, "&advert=+380668846667" and “yassine_lemmou”. * **Fabian Wosar** works at Emsisoft and has written decrypters for plenty of ransomware variants. * The decrypter for GandCrab was released on www.nomoreransom.org by Romanian Police (IGPR), in collaboration with Bitdefender and **Europol** * On a hacking forum (exploit.in), a scam surfaced which used a sensitive topic: soliciting donations to help “sick children”. The scam was quickly identified by other forum members, including the author of GandCrab. As punishment, GandCrab’s author choose to publicize the scammer’s phone number **+380668846667** in their code. * [**Yassine Lemmou**](https://twitter.com/yassine_lemmou?lang=en) is another security researcher who focuses on ransomware. Let’s get back to RC4 key. ![Image 21: Use of GetTickCount() for random number](https://staticfiles.acronis.com/images/content/4e6c3083e3ff488540cce9eedeb6ecd2.png) Use of GetTickCount() for random number _Figure 19: Use of GetTickCount() for random number_ ![Image 22: Hardcoded array of strings used for generating pseudo random string](https://staticfiles.acronis.com/images/content/8de9bd59f5f2ac1900067036e82c804a.png) Hardcoded array of strings used for generating pseudo random string _Figure 20: Hardcoded array of strings used for generating_ _pseudo_ _random_ _string_ For some reason, if no string is returned by this function, a hardcode string “popkadurak” is used for this purpose. ![Image 23: Fall back mechanism for random string generation](https://staticfiles.acronis.com/images/content/11b7d3e41e13df30ef331a6e4fd3e0b4.png) Fall back mechanism for random string generation _Figure 21: Fall back mechanism for random string generation_ The randomly generated string looks something like this: ![Image 24: randomly generated string](https://staticfiles.acronis.com/images/content/b459e63f02f2911e68ebf1eb32a2592e.png) randomly generated string Finally, to generate the RC4 key, the code below calculates the CRC32 hash of this string and appends it with string ‘europol’. ![Image 25: Code to generate RC4 key](https://staticfiles.acronis.com/images/content/ef5a51ee52b0013fe8893de916149d11.png) Code to generate RC4 key _Figure 22: Code to generate_ _RC4_ _key_ The string is sent to the control server by using it as the _objectName_ field of _HttpOpenRequestW()._ ![Image 26: Sending string used to generate RC4 key to the server](https://staticfiles.acronis.com/images/content/287511353b265646cea1d87f89e7540a.png) Sending string used to generate RC4 key to the server _Figure 23: Sending string used to generate_ _RC4_ _key to the server_ ### AES keys GandCrab uses a 256-bit key and 128-bit IV for AES encryption, which are generated using a cryptographic random number generator. ![Image 27: AES key and IV](https://staticfiles.acronis.com/images/content/589cfe85cef59a42b4d0e0b07c54ebe4.png) AES key and IV _Figure 24: AES key and IV_ ## Files and directory enumeration The process begins with decrypting an extension name list that is stored in an XOR encrypted form within the binary (using the same key and decryption technique mentioned in the very first section of this technical analysis). GandCrab loops through all logical drives from “A:” to “Z:” and if the drive type is greater than or equal to 0x2 and not equal to 0x5 – which basically means all drive types excluding CR-ROM drive – it creates a separate thread to enumerate and encrypt all files that are identified for encryption. ![Image 28: Enumerate all logical drives](https://staticfiles.acronis.com/images/content/9084b861f42dded99c8c0535fec163c2.png) Enumerate all logical drives _Figure 25: Enumerate all logical drives_ In these separate threads created for each logical drive, GandCrab enumerates directories and sub-directories for the available files. If the directory name, file name or file extension is not present in the exclusion list it, proceeds for encryption. It excludes the following folders and files. However, the excluded path has to go through an additional check before the files inside are exempted from encryption. This check is that excluded path should also not contain **_“SQL”_**, otherwise it will be treated as any other non-excluded folder. This is a new functionality seen exclusively in the latest version of GandCrab v2.3.1. So, for example _“_ _C:\_ _**Program Files**_\_Microsoft_ _**SQL**_ _Server\”_ is not exempted whereas “_C:\_ _**Program Files**_\_Mozilla Firefox_\_”_ is. **Folder Location** **Possible reason for exclusion** **ProgramData** String based match is done to ensure essential system and software files are not encrypted, since they are required to keep system up and running **IETldCache** Browser indexer file **Boot** Contain files related to boot process **Program Files** Software folders are not of interest to the attacker, as no important user files are stored here. Encrypting these will just break the system **Tor Browser** Files essential for using the Tor browser, which the victim uses to pay the ransom **Ransomware** It’s not good to encrypt files in the directory named Ransomware, since you never know what it could be inside. It may have been created by anti-ransomware software **All Users** **Local Settings** **Windows** Essential Windows files **CSIDL_PROGRAM_FILESX86** Excluding “program file” folder is based on environmental variables **CSIDL_PROGRAM_FILES_COMMON** **CSIDL_WINDOWS** **CSIDL_LOCAL_APPDATA** Appdata folder **Excluded files** **desktop.ini** **autorun.inf** **ntuser.dat** **iconcache.db** **bootsect.bak** **boot.ini** **ntuser.dat.log** **thumbs.db** **CRAB-DECRYPT.txt** If folders are not on the excluded list and not in the DESKTOP or COMMON DESKTOP directories, it drops the personalized ransom note file _“CRAB-DECRYPT.txt”_ that was generated in the early stage of its execution. The final check is to exclude files having following extensions: ![Image 29: File extension to exclude](https://staticfiles.acronis.com/images/content/7c7cabe792bbf00dbd42ecf3e2c8e4fa.png) File extension to exclude _Figure 26: File extension to exclude_ In the version of GandCrab prior to v2.0, unlike the current exclusion list of file extensions, it maintained an inclusion list that specified only the extensions to be encrypted. ![Image 30: GandCrab v < 2.0 file extension list](https://staticfiles.acronis.com/images/content/046f4a67a1bcab84a33fd6491cbcf565.png) GandCrab v < 2.0 file extension list _Figure 27:_ _GandCrab_ _v < 2.0 file extension list_ ## File encryption Before any modification is made to the file’s content, GandCrab renames the file by appending “. CRAB” at the end of the original file name. The renamed files are then encrypted using AES 256-bit encryption. The AES key and IV used for encryption are unique to each file (as we stated earlier in the Key Generation section). The AES encryption algorithm is manually implemented as a user-defined function in GandCrab and it does not use any libraries for the same. The AES key and IV are copied to new buffers, which get encrypted with the 2048-bit RSA public key generated for the victim’s machine. File contents are read in chunks of 0x100000 bytes until the end of file. It is then encrypted with AES encryption and written back to the same offset from where they were read. The bytes are 0 padded for encryption and aligned in multiple of 0xF byte boundary while writing back. ![Image 31: File read and encrypt](https://staticfiles.acronis.com/images/content/1e3cc4ad4b30c2dab3521a6c3d37f3f4.png) File read and encrypt _Figure 28: File read and encrypt_ After a file’s contents are fully encrypted, buffers (sized 0x100 bytes each) containing encrypted AES KEY and IV are appended to the file. Lastly, the length of original file also gets appended to the end. ![Image 32: Appending KEY, IV and Original file length](https://staticfiles.acronis.com/images/content/69e5d944a33f9e3a8cae9127b5161aa9.png) Appending KEY, IV and Original file length _Figure 29: Appending KEY, IV and Original file length_ The structure of encrypted file is shown in below image. ![Image 33: Structure of encrypted file](https://staticfiles.acronis.com/images/content/bdb545b12612864cd32da4b1146cf2d2.png) Structure of encrypted file _Figure 30: Structure of encrypted file_ ![Image 34: Sample encrypted file](https://staticfiles.acronis.com/images/content/a3d096db0db196b6b9e2f5dce31f0f1e.png) Sample encrypted file _Figure 31: Sample encrypted file_ Entropy comparison between plain and encrypted files: ![Image 35: Entropy comparison between plain and encrypted file](https://staticfiles.acronis.com/images/content/8d533ef02331de9d2fc529f9a67e164d.png) Entropy comparison between plain and encrypted file _Figure 32: Entropy_ ## Communication with server GandCrab establishes communications with the control server twice throughout the complete course of its execution. ![Image 36: Network communication call graph](https://staticfiles.acronis.com/images/content/c5f235ead5b74b6d864858b8bcdb52a9.png) Network communication call graph _Figure 33: Network communication call graph_ To establish a connection, it tries to resolve domain names to IP addresses using Windows’ NSLOOKUP utility and hardcoded DNS server names. The IP address retrieved by NSLOOKUP will then be used to open a new connection to the server, communicate the data collected from the victim’s machine, and receive commands to decide further actions like deleting itself from the machine. NSLOOKUP is executed using the _CreateProcess()_ API and all the outputs are redirected to a PIPE object created by GandCrab for inter-process communication. After executing the utility, it checks the output by reading from this PIPE object and looks for IP address-like strings. If no IP-like strings are found, GandCrab returns **_“fabian wosar <3”_**. The return value is compared by the caller function and if it’s equal to “fabian wosar <3”, the domain resolution operation is repeated continuously with a pause every 10 seconds until a different string is received. The following command is executed using _CreateProcess()_ API 1. _nslookup zonealarm.bit ns1.corp-servers.ru_ 2. _nslookup ransomware.bit ns1.corp-servers.ru_ 3. _nslookup zonealarm.bit ns2.corp-servers.ru_ 4. _nslookup ransomware.bit ns2.corp-servers.ru_ When tested, the following IPs were retrieved by using these commands. **Domain name** **DNS server** **IP address** **zonealarm.bit** ns1.corp-servers.ru 178.169.217.56 46.238.18.157 85.196.145.46 92.52.201.19 91.139.200.135 80.80.165.93 95.65.95.105 85.105.167.110 193.107.99.167 81.12.175.59 **ransomware.bit** ns1.corp-servers.ru 85.105.167.110 193.107.99.167 81.12.175.59 178.169.217.56 46.238.18.157 85.196.145.46 92.52.201.19 91.139.200.135 80.80.165.93 95.65.95.105 **zonealarm.bit** ns2.corp-servers.ru 81.12.175.59 178.169.217.56 46.238.18.157 85.196.145.46 92.52.201.19 91.139.200.135 80.80.165.93 95.65.95.105 85.105.167.110 193.107.99.167 **ransomware.bit** ns2.corp-servers.ru 95.65.95.105 85.105.167.110 193.107.99.167 81.12.175.59 178.169.217.56 46.238.18.157 85.196.145.46 92.52.201.19 91.139.200.135 80.80.165.93 _Figure 34: List of IPs_ These different calls are used to send information collected before and after the encryption process. The **_CnC\_Call\_1_** is executed just after the RSA key pairs are generated, which are sent immediately to the server (along with other information) in an encrypted form using RC4 encryption. The information sent in CnC_Call_1 is shown in _Figure 18_ and the RC4 key generation is also explained in the Key Generation section. The **_CnC\_Call\_2_** is invoked when all threads performing the file encryption process finishes. To check that all threads have finished their operations, the _WaitForMultipleObjects()_ API is used. In this final communication with the server, GandCrab sends following information: **Filed** **Value** **action** result **e_files** 15594 Number of files encrypted **e_size** 508253439 total size **e_time** 94719 time elapsed between start of encryption and finish for all threads. **pc_group** WORKGROUP **ransom_id** 1ca7f{redacted}1ecb There is function within these control server communication calls that enables self-deletion of the malware if communication is successful between the server and the GandCrab binary. This function is only activated during first communication call, which happens before encryption. ![Image 37: Self deleting code](https://staticfiles.acronis.com/images/content/9f1ad746704fd2e08edb01b6a87e865c.png) Self deleting code _Figure 35:_ _Self deleting_ _code_ ## Final Steps If it’s running with administrator privileges, GandCrab tries to delete all shadow copies of user data, which are automatic backups of user files created by WINDOWS VSS (Volume Shadow Copy Service). In GandCrab v2.3.1, we have seen another new functionality whereby it tries check if the current execution path contains “\\MICROSOFT\\”. If not, it reboots the machine. On restart, GandCrab can execute automatically with the help of the one-time persistence key that was previously created. This key contains the executable path for the copy of GandCrab which is present in “_%APPDATA%\\microsoft\\.exe”._ Basically, in this version, GandCrab does not wait for the user to reboot the machine to execute – rather it forces the reboot and completes it execution activity without relying on the user’s actions. Ultimately, like all previous version, it opens the Tor download URL https://www.torproject.org/download/download-easy.html.en, providing the victim with a clear start to download the TOR browser so they can pay the ransom and recover their data. ## Ransom Note ![Image 38: Ransom note](https://staticfiles.acronis.com/images/content/cc7533510d54a3aa7e36c05548b1c5e3.png) Ransom note _Figure 36: Ransom note_ ## Conclusion Ransomware is constantly getting better and more sophisticated due to the continuous efforts attackers dedicate to their development. To stay ahead of such threat, it’s necessary for users and business to have state-of-the-art defenses that are enabled with machine learning and heuristics. Products like [Acronis True Image 2020](https://www.acronis.com/en-us/personal/computer-backup/) that have [Acronis Active Protection](https://www.acronis.com/en-us/active-protection/) included are able to protect users against such ransomware attacks. ![Image 39: Acronis detects all version of GandCrab ransomware](https://staticfiles.acronis.com/images/content/7eca78d25b2913b08b99e31e38b6baee.png) Acronis detects all version of GandCrab ransomware _Figure 37: Acronis detects all version of_ _GandCrab_ _ransomware_ [Cybersecurity](https://www.acronis.com/en/blog/tags/cybersecurity/) [Ransomware protection](https://www.acronis.com/en/blog/tags/ransomware-protection/) [Antivirus protection](https://www.acronis.com/en/blog/tags/antivirus-protection/) [Corporate cybersecurity](https://www.acronis.com/en/blog/tags/corporate-cybersecurity/) [Cyber protection for businesses](https://www.acronis.com/en/blog/tags/cyber-protection-for-business/) [Security software for business](https://www.acronis.com/en/blog/tags/security-software-for-business/) ## Written by ![Image 40: Acronis Editorial Team](https://staticfiles.acronis.com/images/content/d85707ae91461544212d39836dc32b42.png) Acronis Editorial Team Acronis is a global cyber protection company that provides natively integrated cybersecurity, data protection, and endpoint management for managed service providers (MSPs), small and medium businesses (SMBs), and enterprise IT departments. [Previous post](https://www.acronis.com/en/blog/posts/how-to-backup/) [How to Backup: Computer, Android or iPhone – The Ultimate Guide](https://www.acronis.com/en/blog/posts/how-to-backup/) [Next post](https://www.acronis.com/en/blog/posts/data-keeper/) [Data Keeper: RaaS new offering](https://www.acronis.com/en/blog/posts/data-keeper/) About Acronis Acronis is a leader in AI-native cyber protection, unifying data protection, cybersecurity, IT operations and hybrid infrastructure to deliver business continuity, security and compliance with less cost and complexity. More than 21,000 service providers trust Acronis to protect over 750,000 businesses in 150 countries. Acronis is headquartered in Schaffhausen, Switzerland. [Add as a preferred source on Google](https://google.com/preferences/source?q=acronis.com) ## Related stories Want to learn more? Read the latest stories featuring this solution on our blog. [Acronis Blog](https://www.acronis.com/en/blog/) ![Image 41: stc Bahrain and Acronis partner to bring advanced endpoint security to businesses in Bahrain](https://staticfiles.acronis.com/images/blog-card/9600f3eea83b8f4e168ea6c1409c8c26.png) [stc Bahrain and Acronis partner to bring advanced endpoint security to businesses in Bahrain](https://www.acronis.com/en/blog/posts/stc-bahrain-and-acronis-partner-to-bring-endpoint-security-to-businesses/) We are proud to announce a strategic partnership with stc Bahrain, expanding access to advanced cybersecurity services for businesses across Bahrain. **October 26, 2026**3 min read ![Image 42: Acronis expands MDR toward broader workspace protection](https://staticfiles.acronis.com/images/blog-card/18e90e89f5ec4ef0901f19008d4ccbf2.png) [Acronis expands MDR toward broader workspace protection](https://www.acronis.com/en/blog/posts/acronis-expands-mdr-toward-broader-workspace-protection/) Acronis is expanding the MDR service with capabilities that make this expertise easier to deliver and help partners address more risks. The developments build on a broader commitment to managed security: helping service providers protect the connected workspace while giving customers access to the expertise needed to investigate threats, respond effectively and maintain business continuity. **October 13, 2026**6 min read ![Image 43: Acronis Cyber Protect v17: Improving cyber resilience across people, data and infrastructure](https://staticfiles.acronis.com/images/blog-card/c2467c28c0278609eb3560cb2a8a4d53.png) [Acronis Cyber Protect v17: Improving cyber resilience across people, data and infrastructure](https://www.acronis.com/en/blog/posts/acronis-cyber-protect-v17-improving-cyber-resilience-across-people-data-and-infrastructure/) Acronis Cyber Protect v17 Q3 2026 expands integrated cyber protection with new capabilities that strengthen security awareness, improve backup operations and extend protection across more virtual environments. The result is stronger cyber resilience, simplified operations and broader protection delivered through a single platform. **October 05, 2026**4 min read