A friend of mine was recently attacked by this new cryptolocker in an unusual way. I anticipate my question: what kind of cryptolocker is this, what could the attack vector be, and is a cure available to recover files? I know, and explained to the party, that the second is unlikely.
My friend ran a server with Win10 Enterprise. The day after office closed, Aug 13th, the malware attacked the system. It renamed target files (I have seen PDFs, XLSXs for now) into
.exes by adding a long extension
to get password email id [....] to firstname.lastname@example.org where a long number stands instead of bracketed text.
The infection spreaded to MS OneDrive, where all files where encrypted and their originals deleted (we hope simply "trashed", so MS could have a backup).
The machine was unattended at the time of the infection. I don't have a sterile computer at the moment, and I won't dare open the
exe files on any other machine until I get my hands on one. It's the best way to infect another machine.
I have doubts that this cryptolocker is capable of penetrating an unattended server (remote desktop was disabled, I have no record about it being firewalled correctly, let's suppose not) like WannaCry did. The infection did not spread into the LAN computers running Windows 10 when the office reopened and those computers were re-powered.
I don't yet have access to encrypted data. I just got a phone call and could see how the OneDrive files looked like, without opening any.
My research (link to VirusTotal not available here at the moment) found that the encrypted exe files may be plain SFX rar files, judging from the content type. So at least there are known rar password crackers, despite a brute force may be irrealistic.
Any info on this tool?