GandCrab Ransomware IOC Feed

GandCrab ransomware was one of the most active ransomware families up until mid-2019. Some of its recent successors include Maze, Ryuk, Conti, DoppelPaymer and others. The GandCrab ransomware-as-a-service (RaaS) operation shut down in June 2019. This page is being maintained for historical reasons.

GandCrab notably used the .bit TLD for Command & Control. Commonly used .bit C&C’s for GandCrab include ransomware.bit, zonealarm.bit, and carder.bit.

As mentioned, the malware was known to be distributed using a Ransomware as a Service (RaaS) model. As a result there were several distinct actors and distribution vectors including malicious attachments in spam emails and the RIG exploit kit.

Below you will find historical GandCrab Ransomware Indicators of Compromise (IOC’s) from our Threat Intelligence feed. All of these indicators were internally verified using custom YARA rules and behavioural signatures. For live threat intelligence data including ransomware IOC’s from currently active families, please sign up for a free trial.