GANDCRAB v5.2 – How to Decrypt Encrypted Files (Free)
THREAT REMOVAL

GANDCRAB v5.2 – How to Decrypt Encrypted Files (Free)

1 Star2 Stars3 Stars4 Stars5 Stars (No Ratings Yet)
Loading...

What is GandCrab v5.2 ransomware? How to remove GandCrab v5.2? How to decrypt files, encrypted by GandCrab v5.2 ransomware virus from your computer effectively?

GANDCRAB v5.2 is an extremely dangerous family of malware infections, whose malware family has been infecting people’s computers for almost 2 years now. The virus has officially been shut down by it’s creators and thanks to that, researchers have now devised a free decryption software, that can help you get your files back for free, if you have backed them up somewhere. The virus’s main goal was to infect the computer and then scramble all of the files in it that are important – documents, videos, images and other files and then extort the victims to pay ransom to get the files to work again. Read this article to learn how to remove GandCrab ransomware and how to try and decrypt your files for free without paying ransom.

Threat Summary

NameGANDCRAB v5.2
TypeRansomware, Cryptovirus
Short DescriptionThe 5.2 version of a very dangerous cryptovirs, that encrypts your files and holds them hostage until you pay ransom to get the files back.
SymptomsFiles are encrypted and no longer have the same name or extension. They cannot be opened. The wallpaper is changed into GandCrab v5.2 one.
Distribution MethodSpam Emails, Email Attachments, Executable files
Removal Tool Remove GANDCRAB v5.2 Now

Download

Malware Removal Tool

User ExperienceJoin Our Forum to Discuss GANDCRAB v5.2.
Decryption StepsDecryption Instructions for GandCrab v 5.2 ransomware.

How to Remove GandCrab v5.2 and Decrypt Files

This part contains step-by-step guide on removing and decrypting files, encrypted by GandCrab v5.2 ransomware virus.

GandCrab Ransomware Decryption Instructions

The encryption process of the first versions of GandCrab (v1, v2 and v3) used AES-256 encryption with a Cipher Block Chaining. The newer versions (v4 and v5, including v5.2) now use Salsa20 algorithm. The virus used to encrypt a larger portion of the files, risking to damage them, but now it encrypts only a small portion of the files via Salsa20, enough to render them no longer able to be opened. This is how the researchers have managed to reach a breakthrough and the result of that is the BitDefender GandCrab Decryptor. Below, you can find instructions on how you can restore files, encrypted by this version of GandCrab (v5.2) for free.

Important! Before decrypting your encrypted files by GandCrab 5.2, you will need to have at least one ransom note from your infection, which is required to recover the decryption key. So, before removing the virus files, make a copy of the ransom note on a flash drive or other external drive. Make sure to do this before scanning your PC.

Before decrypting GandCrab v5.2, it is important to neutralize the threat first. The most preferred way to remove GandCrab v5.2 ransomware is by downloading an anti-malware program and running a scan. Such a program is designed to remove malware automatically and to further protect the system.


SpyHunter scanner will only detect the threat. If you want the threat to be automatically removed, you need to purchase the full version of the anti-malware tool.Find Out More About SpyHunter Anti-Malware Tool / How to Uninstall SpyHunter

Decryption Steps

Preparation Phase

Important! Before beginning decryption, make sure that you are connected to the internet as the BitDefender GandCrab V1, V4, V5 Decryptor works with BitDefneder’s servers to find the decryption keys and recover your files.

Be advised, that before decryption, you will also need to do the following:

  • Make copies of the encrypted files, because tinkering with copies is safer and even if they get damaged, you will still have the original files.
  • Make sure to secure your computer.
  • Make sure to have at least one GandCrab v5.2 ransom note. For this variant it is called “{YOUR EXTENSION}-DECRYPT.txt”
  • Be prepared to wait for the decrypter and do not interupt the decryption process.

Step 1: Download the BitDefender GandCrab Decryptor by clicking on the download button underneath:

Step 2: Save the file where you can find it and Run it:

Step 3: Agree with the Software License Agreement by clicking “I Agree”.

Step 4: If you want specific encrypted files by GandCrab v5.2 in a single folder to be decrypted, select them by clicking on “Browse”. If you want all files on your computer to be decrypted, tick “Scan Entire System”.

Step 5: Do not forget to tick “Backup Files” before begging, in case something goes wrong. If you see the “Ready to scan” indicator, click on the “Scan” button to begin the decryption process.

Step 6: The software will begin looking for the decryption keys for files, encoded by GandCrab v5.2. Be advised that this will definitely take some significant time so arm yourself with patience.

Step 7: When the software has finished decrypting your files, you should find them in the folder:

Be advised to check if all of your files are DECRYPTED successfully before removing the encrypted ones. To remove the encrypted files, you can search them by using Windows search. This can happen by opening “This PC” (My Computer) in Windows and then in the search bar on it’s top-right type the follow and search for it:

→ fileextension:{the extension of your files}

The files should start appearing and when the search is done, press CTRL+A to select all and then press Shift+Del to delete all of the files simultaneously:

Video, containing decryption instructions for GandCrab v5.2 ransomware:

Conclusion and Important Tips

Keep in mind that this decryption tool will first try to decrypt 5 files and if this test does not pass, it will not continue, although the probability for that is very low. Also note that BitDefender researchers find it important to receive any feedback, so if you fail to decrypt your files, you should contact them on [email protected] and send them the log file of the decryption process, which is usually located in %Temp%\BDRemovalTool directory.

Ventsislav Krastev

Ventsislav has been covering the latest malware, software and newest tech developments at SensorsTechForum for 3 years now. He started out as a network administrator. Having graduated Marketing as well, Ventsislav also has passion for discovery of new shifts and innovations in cybersecurity that become game changers. After studying Value Chain Management and then Network Administration, he found his passion within cybersecrurity and is a strong believer in basic education of every user towards online safety.

More Posts - Website

2 Comments

  1. roby munandar

    thank you so muchhhh for decryptor v5.2
    ilove so much save my life

    Reply
    1. Milena Dimitrova

      Hi Roby,

      We’re glad you recovered your files! Cheers!

      Reply

Leave a Comment

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.

Share on Facebook Share
Loading...
Share on Twitter Tweet
Loading...
Share on Google Plus Share
Loading...
Share on Linkedin Share
Loading...
Share on Digg Share
Share on Reddit Share
Loading...
Share on Stumbleupon Share
Loading...