信件样本：
文件名字：CRAB-DECRYPT.txt
中毒特征：所有文件添加一个扩展名：.CRAB
文件内容：
—= GANDCRAB V3 =—
Attention!
All your files documents, photos, databases and other important files are encrypted and have the extension: .CRAB
The only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.
The server with your key is in a closed network TOR. You can get there by the following ways:
0. Download Tor browser – https://www.torproject.org/
1. Install Tor browser
2. Open Tor Browser
3. Open link in TOR browser: http://gandcrab2pie73et.onion/f204fd37566af699
4. Follow the instructions on this page
On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.
The alternative way to contact us is to use Jabber messanger. Read how to:
0. Download Psi-Plus Jabber Client: https://psi-im.org/download/
1. Register new account: http://sj.ms/register.php
0) Enter "username": f204fd37566af699
1) Enter "password": your password
2. Add new account in Psi
3. Add and write Jabber ID: ransomware@sj.ms any message
4. Follow instruction bot
ATTENTION!
It is a bot! It's fully automated artificial system without human control!
To contact us use TOR links. We can provide you all required proofs of decryption availibility anytime. We are open to conversations.
You can read instructions how to install and use jabber here http://www.sfu.ca/jabber/Psi_Jabber_PC.pdf
CAUGHTION!
Do not try to modify files or use your own private key. This will result in the loss of your data forever!
加密算法：
全字节加密，不是仅仅加密一部分，不论文件的大小，均采用一个算法。
解密研究：
研究中…
常见问题解答
GANDCRAB V3病毒是如何加密文件的？
GANDCRAB V3病毒会加密用户电脑上的所有重要文件，包括文档、照片和数据库等，并在每个加密文件后添加.CRAB扩展名。加密完成后，病毒会在文件夹中留下名为CRAB-DECRYPT.txt的勒索信，告知用户文件已被加密，只有购买私钥才能恢复。
中了GANDCRAB V3病毒后，如何联系黑客获取解密钥匙？
感染GANDCRAB V3后，黑客会在勒索信中提供获取私钥的途径。用户需要下载Tor浏览器，安装并打开后，访问信中给出的.onion暗网链接（例如http://gandcrab2pie73et.onion/f204fd37566af699），在该页面中按照指示支付赎金以获取解密私钥。
GANDCRAB V3病毒的勒索信内容有哪些关键信息？
勒索信（CRAB-DECRYPT.txt）主要包含以下关键信息：声明所有文件已被加密，并添加了.CRAB扩展名；强调只有购买私钥才能恢复文件；提供访问暗网服务器的具体步骤，包括下载Tor浏览器、安装并打开，然后访问特定的.onion链接；最后通常会附上个人标识符（如f204fd37566af699），用于识别受害者。