0

Today, one of my end users using Windows 7 (for reference) got infected with a ransomware variant that weirdly enough doesn't seem to have changed the files's extensions.

Is this possible? Is there a mechanism to hide the extension? Because all files seem to be normal in that sense.

Based on the .txt and .png files with the message for the user, I think it might be a Cerber variant, but I'm not sure.

|improve this question
5

Is this possible?

Of course it is. It doesn't have to change the filenames at all. It just encrypts the content.

Is there a mechanism to hide the extension? Because all files seem to be normal in that sense.

Yes, you could name it foo.txt.enc and then enable the "Hide extensions" option in Explorer. But as I mentioned above, it doesn't have to change the extension at all.

|improve this answer
  • Interesting. Do you know which variant is currently doing this? – Jean Carlos Suárez Marranzini Apr 29 '16 at 14:48
  • Most ransomware uses the extension to determine if its a file it should encrypt, and then therefore after the extension changes it knows not to touch the file again. Without using the filename as semaphore for encryption state, it could repeatedly encrypt already encrypted files when it restarts (such as if the system reboots) which makes it more likely they will just end up a scrambled mess that cant be recovered even if the ransom is paid. Some poorly written variants work this way. – Jeff Meden Apr 29 '16 at 14:52
  • 1
    @JeffMeden Or it could just add a known identifier to the start (or end) of the file contents to show it was encrypted. Or just assume that, after its first run, all file types with specific extensions were already encrypted. The possibilities are numerous. – Polynomial Apr 29 '16 at 15:05
  • @JeanCarlosSuárezMarranzini Not off the top of my head. There are so many out there, both prevalent and less-so, that it's almost impossible to guess in most cases from behaviour like this. As you noted, the ransom note is a much better indicator. – Polynomial Apr 29 '16 at 15:06
  • The possibilities are numerous but that's how the landscape has shaped up for some reason. One wonders why they ever started the extension changing trick at all since its so easy to systematically detect during the attack, yet that's what all of the currently popular variants do. – Jeff Meden Apr 29 '16 at 16:27
0

Ransomware does not touch files with extensioins like *.lib . That means you can make your backups and name them *.lib instead of *.bak.

|improve this answer
  • Malware doesn't work that way anymore (at least for now a days). Recently I just got infected by a ransom ware. Those jpg files which I named as .jpgaaa were all infected as well. – user3437460 Feb 24 '17 at 9:02

Not the answer you're looking for? Browse other questions tagged or ask your own question.