Today, one of my end users using Windows 7 (for reference) got infected with a ransomware variant that weirdly enough doesn't seem to have changed the files's extensions.

Is this possible? Is there a mechanism to hide the extension? Because all files seem to be normal in that sense.

Based on the .txt and .png files with the message for the user, I think it might be a Cerber variant, but I'm not sure.

  • Wanted to add the following link which may help you determine (if you already haven't) what you were hit with: docs.google.com/spreadsheets/d/…
    – munkeyoto
    Commented May 10, 2016 at 17:04
  • ID ransomware is also very useful in identifying the type of ransomware you're dealing with. Commented Aug 31, 2016 at 15:47

2 Answers 2


Is this possible?

Of course it is. It doesn't have to change the filenames at all. It just encrypts the content.

Is there a mechanism to hide the extension? Because all files seem to be normal in that sense.

Yes, you could name it foo.txt.enc and then enable the "Hide extensions" option in Explorer. But as I mentioned above, it doesn't have to change the extension at all.

  • Interesting. Do you know which variant is currently doing this? Commented Apr 29, 2016 at 14:48
  • Most ransomware uses the extension to determine if its a file it should encrypt, and then therefore after the extension changes it knows not to touch the file again. Without using the filename as semaphore for encryption state, it could repeatedly encrypt already encrypted files when it restarts (such as if the system reboots) which makes it more likely they will just end up a scrambled mess that cant be recovered even if the ransom is paid. Some poorly written variants work this way.
    – Jeff Meden
    Commented Apr 29, 2016 at 14:52
  • 1
    @JeffMeden Or it could just add a known identifier to the start (or end) of the file contents to show it was encrypted. Or just assume that, after its first run, all file types with specific extensions were already encrypted. The possibilities are numerous.
    – Polynomial
    Commented Apr 29, 2016 at 15:05
  • @JeanCarlosSuárezMarranzini Not off the top of my head. There are so many out there, both prevalent and less-so, that it's almost impossible to guess in most cases from behaviour like this. As you noted, the ransom note is a much better indicator.
    – Polynomial
    Commented Apr 29, 2016 at 15:06
  • The possibilities are numerous but that's how the landscape has shaped up for some reason. One wonders why they ever started the extension changing trick at all since its so easy to systematically detect during the attack, yet that's what all of the currently popular variants do.
    – Jeff Meden
    Commented Apr 29, 2016 at 16:27

Ransomware does not touch files with extensioins like *.lib . That means you can make your backups and name them *.lib instead of *.bak.

  • Malware doesn't work that way anymore (at least for now a days). Recently I just got infected by a ransom ware. Those jpg files which I named as .jpgaaa were all infected as well. Commented Feb 24, 2017 at 9:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .