3

A ransomware attack happened to my server, I've backups and all and I tracked down the reason to two elements (either unupdated Bitnami LAMP stack or unupdated Flask server) but I noticed some files aren't encrypted, any checks I should do to verify that I can use this files safely?

  • Do your logs give any hint if these files were changed while the encrypting process was running? – Tom K. Aug 4 '17 at 16:35
  • I couldn't find any logs regarding the encryption process, but the files I'm going for are not binary files, mostly Python or shell scripts – Marware Aug 4 '17 at 17:13
  • 2
    many ransomware whitelists the file types that it encrypts, so they encrypt only files that likely contains user data, to prevent the system from breaking. Especially encrypting binaries and scripts can cause the system to fail to boot, which would cause them to be unable to deliver the ransom message or fail to restore, which would tarnish their reputation (ransomware groups need to have a good reputation of reliably restoring anyone who pays up, otherwise people would be less likely to pay the ransom). – Lie Ryan Aug 5 '17 at 0:21
3

The way ransomware encrypts files is based on extensions. They add a broad range of extensions to cover the majority of crucial files for working/business/school and so on. That list is not dynamic or cloud/service based, it is usually hard coded into malware itself. At least that's what happened up until now. So if for example, ransomware didn't add .mp3 to the encryption list, it would be skipped, the files would not be affected. You can do a full scan with anti-malware and anti-virus software just to be sure, but I think the data will not be affected and you can use them safely.

Fun fact: This is why having 2 ransomware (One after another) on your computer will not do additional damage. Usually, ransomware doesn't contain other encryptions extensions.

2

The ransomware doesn't encrypt all the files. If you have the name of the ransomware, you can find which files will be encrypted on Internet.

To be sure that your files which aren't encrypted are not altered at all, you can write a script to calculate the hash sum of each files and compare it with you backup (if the files haven't been modify since you backup).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.