recover crab encrypted files

Recommended Posts

My PC got infected yesterday with a ransomware and it has encrypted my files with a .CRAB extension. The text has GANDCRAB V3 written at starting.

Please help me to decrypt my files.

Here is an encrypted file and the note along with it.

Android Image


---= GANDCRAB V3 =---


All your files documents, photos, databases and other important files are encrypted and have the extension: .CRAB 

The only method of recovering files is to purchase a private key. It is on our server and only we can recover your files. 

The server with your key is in a closed network TOR. You can get there by the following ways: 

0. Download Tor browser -

1. Install Tor browser 

2. Open Tor Browser 

3. Open link in TOR browser: http://gandcrab2pie73et.onion/b3fcdd2cb6106c52                        

4. Follow the instructions on this page 

On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. 


It has some more text written giving an alternative way to contact by Jabber Meassanger and has a username written asking to create a new account on a website and then to follow instruction bot.







Edited by GT500
Put ransom note in CODE block so that links aren't clickable.

Share this post

Link to post
Share on other sites
49 minutes ago, Divyansh said:

Please help me to decrypt my files.

What does ID Randomware say about the ransomware?


On 5/29/2018 at 6:43 PM, GT500 said:

I recommend uploading a copy of the ransom note along with an encrypted file to ID Ransomware so that you can verify which ransomware you are dealing with:

You can paste a link to the results into a reply if you would like for me to review them.


Share this post

Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

  • Recently Browsing   0 members

    No registered users viewing this page.