How to tell if BlackByte NT ransomware is on my computer?

Question

The company I work at sadly fell victim to BlackByte NT ransomware this week. It ransomed many of the Windows machines on our factory floor.

I have used my personal laptop (Windows 10 Home, version 22H2, OS build 19045.3693, Dell XPS 15) on the company's Wi-Fi once every few weeks for the past four years. I am afraid that BlackByte NT's worms are on my personal laptop now and can spread to my house.

How can one check to see if BlackByte NT malware is on one's computer?

So far, I have done a full scan using Window's built-in virus & thread protection scanner (updated 11/17/2023), and it finds 0 threats.

Answer 1

Trustwave has done an analysis on this piece of malware. Among the things you probably want to check for if you can includes:

• Check for exclusions of .exe and .js Windows Defender. The ransomware attempts to adds these extensions to the exclusion list.
• Check for the existence of C:\Users\Public\blockator
• Right-click the C:\Windows folder, check the permissions, and make sure Everyone doesn't have Full Control. You can do this by right-clicking Windows, selecting Properties, selecting the Security tab, clicking on Advanced, clicking the "Effective Access" tab, click on the "Select a user" link and type in "Everyone" into the prompt that asks for a user, then clicking "View effective access".
  If you are not infected, there should be Xes on the left hand side.