Is there a known ransomware-variant (Cryptolocker, Cryptowall etc.) that before encrypting the files checks for their magic numbers?
Lets say that there's a Word file, that had its file extension removed or changed to a not-popular one. We'll call it
CC details (or
CC details.qwerty). This file should have
50 4B 03 04 as its magic numbers.
Is there a ransomware known that will scan the contents of the file (or even just the first few lines) to see that it's really a Word file and not something blank?
I checked Google and the most that I could find was the ransomeware kovter, which does scan the file content and obfuscates the first few lines - which leads to an invalid file (doesn't really encrypt it though). That's not really what I'm looking for (though I do think it's somewhat in the right direction).