1

A friend of mine was recently attacked by this new cryptolocker in an unusual way. I anticipate my question: what kind of cryptolocker is this, what could the attack vector be, and is a cure available to recover files? I know, and explained to the party, that the second is unlikely.

My friend ran a server with Win10 Enterprise. The day after office closed, Aug 13th, the malware attacked the system. It renamed target files (I have seen PDFs, XLSXs for now) into .exes by adding a long extension to get password email id [....] to [email protected] where a long number stands instead of bracketed text.

The infection spreaded to MS OneDrive, where all files where encrypted and their originals deleted (we hope simply "trashed", so MS could have a backup).

The machine was unattended at the time of the infection. I don't have a sterile computer at the moment, and I won't dare open the exe files on any other machine until I get my hands on one. It's the best way to infect another machine.

I have doubts that this cryptolocker is capable of penetrating an unattended server (remote desktop was disabled, I have no record about it being firewalled correctly, let's suppose not) like WannaCry did. The infection did not spread into the LAN computers running Windows 10 when the office reopened and those computers were re-powered.

I don't yet have access to encrypted data. I just got a phone call and could see how the OneDrive files looked like, without opening any.

My research (link to VirusTotal not available here at the moment) found that the encrypted exe files may be plain SFX rar files, judging from the content type. So at least there are known rar password crackers, despite a brute force may be irrealistic.

Any info on this tool?

Improve this question
2

1 Answer 1

Reset to default
2

My friend ran a server with Win10 Enterprise.

This is the first mistake.

Anyway, the ransomware could be ACCDFISA v2.0 or a variant of it, see

https://www.bleepingcomputer.com/forums/t/618996/accdfisa-v20-ransomware-support-topic-filename-to-get-password-email-id-id-to-email-exerar/

With ransomware, Bleepingcomputer have a lot of information, q.v.:

https://www.bleepingcomputer.com/virus-removal/threat/ransomware/

It is usually wise not to boot the infected OS again, but (a) make a backup of all encrypted (and other) files to a separate backup destination, then (b) boot a Linux system from a USB or CD/DVD (Live System) then explore from there. In fact, you may often do (a) from (b).

With (a) you may be able to recover the data later when more information (and possibly, a recovery tool) about it is available. For (b) you need technical knowledge.

Easiest might be to replace all infected hard disk, then restore backups to them. Look at the infected hard disk later while your server is already up. Close all ports from the outside that are not needed (e.g. leave only TCP 80 and 443 open) using a firewall.

PS: The attack vector could be an open RDP port, this was observed in the past.

Improve this answer
3
  • Friend swore me that RDP was closed, but I don't really believe it. Clarification: can you confirm that open RDP plus a weak Admin password is the likely attack vector?
    – usr-local-ΕΨΗΕΛΩΝ
    Aug 29, 2017 at 13:51
  • @usr-local-ΕΨΗΕΛΩΝ Until we know exactly what malware it is and we find out how it attacks, there is no way to be 100% sure - after all, it is an event that happened in the past when no-one was watching. I collected information partly in the forum that I referenced, and people there were sure that was the attack vector. The malware looks very similar. So, I would call it likely that it is the main attack vector candidate. On the server, no-one opened an e-mail or browsed the web, so those can be excluded. News items these days also speak of a new type of ransomware attack using RDP on Windows.
    – Ned64
    Aug 29, 2017 at 16:15
  • PS: And oh, passwords can be brute-forced if a login is allowed from the web (distributed if there is rate limiting, which I somehow doubt under that OS)- as long as the password is something short enough and/or human-readable.
    – Ned64
    Aug 29, 2017 at 16:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .