1

A few days ago I noticed a discussion on a website about cryptolockers. Someone said a cryptolocker operates silently untill it has encrypted all files and then comes visible to the user.

The working method was to silently encrypt all files. After it's done, the cryptolockers waits a few weeks and activates itself so there is no present back-up available. If a user tries to open a document in the waiting period, the cryptolocker quickly decrypts the file so you wont notice the encryption.

I don't know if this is true but I haven't heard anyone ever talk about this technique apart from that particular person.

Personally I hardly believe that this kind of cryptolocker exists. like what if the encrypting process/executable is deleted? does that mean all files slam shut or stay open because it can't communicate with the criminal's servers?

I've witnessed about 4 cryptolock attacks on our network. All were immediately noticed because the files were encrypted. you could also tell by the help_decrypt.txt files located in the encrypted directories.

Greetings,

|improve this question
  • Your problem with the theory is that the locker could be deleted? How would a normal home user "delete" a running file system driver, with additional help from some other rootkit stuff? ... While I have no examples, it's very well possible that lockers like this exist. – deviantfan Feb 21 '16 at 12:37
  • So according to you the locker will settle itself on the client computer as a driver? instead of a .exe in the appdata or something like that? But what would happen if the infected client computer shuts down or gets deleted from the network. what will happen to the silent encrypted files on a server's shared directory? – Luuk LG Feb 21 '16 at 12:41
  • The automatic decryption when files are used, during the silent phase, won't be possible with an userland program alone. So yes, a driver, in addition to the normal program. About the network share: No idea :), other than not encrypting network shares – deviantfan Feb 21 '16 at 12:47
  • Than it looks like our network does not really have a risk because we use VDI. the moment you logoff your win7client gets destroyed and a new one is getting deployed from a snapshot. and all the user files are saved on the fileserver. The only thing (but I hardly think it's possible) is that the encryption driver would get installed on the fileserver itself by a normal user. – Luuk LG Feb 21 '16 at 13:12
1

After it's done, the cryptolockers waits a few weeks and activates itself so there is no present back-up available. If a user tries to open a document in the waiting period, the cryptolocker quickly decrypts the file so you wont notice the encryption.

This does not make much sense. A backup process would also try to access the file, so the file would be decrypted during the backup and thus the backup would contain the original file.

Someone said ...

Always ask for the source of such a claim. Just because someone on the internet said something it does not mean that it is correct.

Maybe whoever said this has read about cryptolocker which waits before activation, like described at Locker: Cryptolocker Progeny Awakens. But this is about remaining silent for a long time and only after some time starting to encrypt files. By deferring activation until a specific date the ransomware evades dynamic analysis because it does nothing bad for now. It thus can spread without getting detected before all sleepers get activated at the same time.

|improve this answer
  • I will definitely ask for his source. Have you ever heard of this type cryptolocker? I'm more and more thinking that this type cryptolocker does not exist. about the backup: does this also count for snapshot back-ups? I think it does because I'm able to perform a single file based restore by browsing in the server's directories. – Luuk LG Feb 21 '16 at 13:38
  • So it basically means the cryptolocker executable awaits in a neutral state untill it has spread across mutliple shares. after 2 months is starts to activate. This would mean you would have to restore a back-up and find/remove the executable(s) a.s.a.p. – Luuk LG Feb 21 '16 at 13:51
  • @LuukLG: I think the cryptolocker simply counts on the fact that most people don't care about regular backups at all. The waiting is mainly done to be able to infect silently as much computers as possible. Because once the software is detected as malicious the antivirus will quickly catch up and add it to their signatures. – Steffen Ullrich Feb 21 '16 at 13:55
  • Is there a way I'm able to recognize such sleepers? are they executables or a locally installed program? – Luuk LG Feb 21 '16 at 13:57
  • @LuukLG: There are probably some local files but do you know what all the files on your system are for and if they are not infected? And each infection could be different. If it would be that easy antivirus would have detected such stuff before it got activated. – Steffen Ullrich Feb 21 '16 at 14:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.