Syrian users have received free decryption keys by GandCrab ransomware developers via underground forums. In their statements, they also wrote that no other key will be released in futures. They give free decryption key to Syrian users because of heat-showing tweet by Syrian father who has lose his son in the war and request to recover their photos and videos. Jameel, a Syrian father who lost his children in war started series messages via tweeter and ask to decrypt their files from GandCrab v5.0.3 ransomware.

A GandCrab owner is saying all users will get their decryption key:

Replayed from GandCrab developers, they will send free decryption key for each & every victims of Syrian country. If any one of the users still hasn’t received, it is only matter of time until they get them. However, Hackers suggests to give some information for victims’ identification including image of victims, passport, payment page and other identity.

One thing keep in mind that the crucial information like passport or other identification documents may leads several damages or System privacy issues. So, you should be careful while sharing these crucial data to them. You may see the messages on its notes like “We regret that we did not initially add this country to the exceptions. But at least that way we can help them now. Whose keys are not (only for citizens of Syria and the CIS, Ukraine including) – you need to come to us and take a picture of yourself with a passport and payment page. After that, we will issue a decryptor for free.”. But malware programmers also have same messages.

Free decryption work for all version of GandCrab Ransomare:

They generate decryption key in archived file or .zip file including readme.txt and SY_keys.txt files. In the first documents, information in Russian language and shows how key are organized in file. And second file SY_keys.txt files contains about 1000 of decryption keys. Each line has victims unique ID and decryption key. That’s why, it is too much secure.

GandCrab ransomware has several version that is 1.0.0 to 5.0 that has been developed by GandCarb developers. Recently, this nasty file virus has affected millions of victims PCs worldwide. It is crypto-miner and ransomware that is able to lock all files of victims’ PCs. They are doing mercy with Syrian users and their files that give free decryption key at ones. It is clear that no other decryption will be provided in futures. So, you should be careful and choose legitimate decryption tool for your locked files.