Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [ransomware]

Ransomware is a lethal kind of Malware that Encrypts your harddrive(s) and holds them hostage, providing the decryption key if you pay the hostage-taker(s) money (well-known variants are the FBI Virus and the Police Virus).

0
votes
1answer
96 views

Ransomware on Mycloud NAS

I own a Mycloud NAS and it was affected by ransomware. In the NAS there are several folders, most of them are password protected. There is also the "Public" folder which can be seen by all users and ...
0
votes
1answer
128 views

Why doesn't WannaCry ask to “make changes to this computer” when you run the exe? [duplicate]

When you click on WannaCry, why doesn't it ask "do you want the following program to make changes to your computer?" I've watched videos of people running wannaCry, and it doesn't. I've also watched ...
0
votes
1answer
92 views

Can ransomware virus be removed from an affected PC? [duplicate]

I have had a ransomware attack that has only encrypted some files. Is there any way to find the virus and prevent it from encrypting more files?
0
votes
0answers
65 views

.[fileslocker@pm.me] virus [duplicate]

I have one PC (Windows 7) which is attacked presumably by a ransomware (in spite of having regularly updated antivirus viz Net Protector AV). What I could see is this -- In MySQL/bin folder, all files ...
2
votes
1answer
126 views

Ransomware - All computers infected but one

Let's say there is a particular network which has a "monthly" successful cryptolocker attack. Every time, every computer in that network is infected. The set up is like this: 1x Windows 2003 server (...
1
vote
0answers
66 views

How to prevent the ransomware to run with administrator privileges?

We have been attacked by the ransomware recently (adobe li). The strange thing is that ransomware was able to gain unimaginable high privileges. The virus of the ransomware has been located on the ...
1
vote
1answer
169 views

I found an RSA private key on my ransomware-infected device. Can I use it to decrypt the files?

I have ransomware on my laptop. I ran Spyhunter and deleted as much as I could. I found an RSA in the Windows registry with regedit. Then, as I was checking for unknown files, I found a .android file ...
4
votes
2answers
67 views

Will enabling SMB protocol authentication prevent Ransomware attack like WannaCry spreading in network?

We have a requirement of using SMB protocol due to a system limitation. will enabling SMB authentication among the nodes will prevent the ransomware threat spreading in network? Reference: https://...
-1
votes
2answers
80 views

Ransomware that attacks only mapped drives

Is it possible that ransomware attacks only mapped drives and not the local drive?
2
votes
0answers
2k views

Ransomware with .adobe extension

It is possible to decrypt file with .adobe extension ? File after encryption look like this : filename.id-5735353.[email@example.com].adobe . I did a little research and found information about "....
-1
votes
1answer
66 views

Online traffic monitoring by ISP for safety purposes [closed]

I have a question regarding approach to online security and protection against viruses, malware and phishing by one of the biggest European ISP. Below you will find my understanding of the topic. Is ...
2
votes
1answer
130 views

prevent Ransomware on CIFS shares mounted on Windows 10

I am using Windows 10 with Defender. I follow all the ground rules when dealing with the internet and staying secure. I work in IS so I'm pretty familiar with the various threat-vectors and do a good ...
1
vote
1answer
141 views

Dropbox ransomware experience

How Dropbox handles ransomware issues? Can it effectively restore files encrypted by ransomware? The reason I am asking is because I am looking for a bullet-proof solution against ransomware and ...
2
votes
1answer
128 views

Is this ransomware encryption or file corruption?

I have backups of a user folder from an older drive that I am getting to organizing now and noticed files are either corrupted or encrypted. File extensions and names are not changed, appears exe ...
1
vote
2answers
234 views

Is this a virus or what? DECRYPT_INFORMATION

On my computer there are lots of html files with titles DECRYPT_INFORMATION. I have scanned them with AVG and it says they are no threat but I am suspicious. I don't know html so when I open them on ...
2
votes
1answer
107 views

How does Ransomware use vssadmin.exe with admin privileges

I am doing some research about Ransomware and their methods. In many articles they write that the ransomware performs vssadmin.exe to delete shadow copys. And I found following Information about how ...
0
votes
0answers
141 views

Can WannaCry infect my local network and its devices?

So long story short I wanted to test out WannaCry on my Windows 7 guest machine, thing is I forgot to disable the network connection / interface in virtualbox and ran it. Only seconds later I realized ...
2
votes
1answer
697 views

How dangerous is SMBv1?

I have a NAS (network disk) from Zylex which stopped working under Windows 10 a while ago. Investigation shows that it uses SMBv1, which was implicated in several ransomware attacks and was therefore ...
0
votes
1answer
152 views

Will re-imaging kill ransomware?

Pretty much what the title suggests. I understand its quite vague so apologies. I'm just not sure if it's able to install something that will sit elsewhere on the machine (as in not on the C:) which ...
3
votes
1answer
417 views

Received an email from a Bulgarian address trying to extort money

As the title says, I received an email from some Bulgarian email address saying that the sender has compromised my browser and thereby obtained control over my camera as well as gathering data on all ...
4
votes
1answer
293 views

Reality Check: Create chaos at an office

An opportunity has arisen for me to perform a "real hacking attack" on a TV show. The target is to attack the TV headquarters and cause as much chaos as possible. The idea is to show how a business ...
1
vote
2answers
791 views

Why does WannaCry encrypt symmetric key with a new per-victim-only public key?

According to this answer, WannaCry will: Generate AES key at victim's system to encrypt victim's files. Generate RSA key at victim's system to encrypt AES key generated above. Encrypt private key of ...
3
votes
3answers
365 views

How to prove a false positive

I was notified by my university's infosec team that one of my lab's computers had been infected by ransomware. They shut down the computer's network connections using Crowdstrike and are insisting ...
-1
votes
0answers
73 views

How to protect Windows 10 network backup against ransomware (cryptolock) by removing permissions on NAS

Windows backup has files structure like this: Backup set directory: Backup files directory: I am considering protecting network backup by periodical removing write permission to already uploaded ...
6
votes
1answer
506 views

Why does WannaCry use different AES keys to encrypt different files on host?

I have a question after reading the discussion here: Ransomware encryption keys So I understand the process of WannaCry encryption now, thanks to the accepted answer given by the community on the ...
-1
votes
1answer
93 views

How to find which program encrypted my files? [closed]

I've been infected by a ransomware and all files have extension .lin. how can i find the program that encrypted my files ?
3
votes
2answers
159 views

Why cant i run malware in my Virtual Environment

Im trying to run some malware samples in my Virtual lab to capture their IOC's. Im doing this for my Masters Thesis but i can not seem to get the malware to run. I have downloaded samples from hybrid ...
4
votes
1answer
124 views

How to combat Doxware?

There is seemingly very little information available about the emergence of ransomware; doxware. I could only find a couple of news articles suggesting that doxware encrypts your files, but also ...
-3
votes
1answer
145 views

Can Ransomware impersonate a Windows Domain Account?

Ransomware (Globe Imposter) was found on one of our production servers. The executable was found in the documents folder of one of our employees on the same server. A Windows Scheduled Task was also ...
1
vote
1answer
2k views

Dharma ransomeware files decryption [closed]

One of my clients send me some picture that shows they infected by some ransomware. As i analysed i found that ransomware is probably Dharma ransomware, child of Crysis. so i tried to decrypt files ...
2
votes
0answers
204 views

How to implement a Crysis ransomware master key?

I see there have been master keys released to decrypt computers affected by the Crysis ransomware. If a computer is infected with Crysis, how would one actually test/run the key on the computer? ...
2
votes
2answers
267 views

Is this Backup Safe from Ransomware?

I'm planning a home backup setup, and I'm not sure if I really understand this quite right. The idea is I'll set up a Linux server on the network that contains two drives. Drive1 will be network-...
1
vote
1answer
258 views

Why do some ransomware executables run on VirtualBox? [closed]

Even though they appears to have anti-VM capabilities? I've downloaded some latest samples of ransomware executables from cerber, locky, and other family of ransomware Why do they still execute in ...
0
votes
1answer
62 views

Finding/Predicting BotNet Generated Domains Without DGA Knowledge

I will pose an academic perspective in my question, but I welcome any and every observation. So a botnet would generate 1000s of domain/day and an actual attacker will register a few, which will be ...
2
votes
4answers
179 views

Why is phishing becoming synonymous with ransomware?

The Wikipedia definition of phishing is: the fraudulent practice of sending emails purporting to be from reputable companies in order to induce individuals to reveal personal information, such as ...
5
votes
2answers
629 views

Are we safe from infection of Bad Rabbit?

I'm doing an assessment on the potential outspread of Bad Rabbit in our organization. Our staff do not have admin privileges on their host machines. We have also blocked the IOCs. Am I safe to say ...
4
votes
1answer
223 views

How do I use google drive local folder with auto sync while protecting myself from ransomware?

Background So I have my Google Drive 1TB account. Obviously, I'm using Drive to have a backup for all my precious files. I used to have a local Drive folder with auto sync on my PC. It was very ...
0
votes
1answer
101 views

Ransom-ware nuclear. how did it get into my pc? [closed]

Got infected, it happened as i was sitting on the PC (Windows 10), i noticed a slow-down and one of the external disks had high activity, upon inspection noticed some files had the .nuclear extension. ...
4
votes
1answer
3k views

WannaCry Source Code

Maybe this is a stupid question: Is the WannaCry source code public? https ://github.com/svenvdz/wannacry https: //github.com/Hackstar7/WanaCry https: //github.com/fadyosman/WannaCrySample I didn'...
3
votes
1answer
689 views

Can you find the ransomware key if you already have decrypted files?

Disclaimer: I have very very little experience with ransomware/encryption, so I'm sorry if I ask something stupid. Ransomware attacks are all over the news, especially this year. And this got me ...
5
votes
5answers
247 views

In the era of cryptolockers, is it possible to prevent Windows from modifying your Linux partition?

I could imagine that in few years, cryptolockers could become so advanced that instead of just encrypting some files on the partition of the current OS, they could also touch all other partitions on ...
1
vote
4answers
259 views

How can I defend my mail server against ransomware?

First of all I'm aware that I should use some anti-virus mechanism to prevent as much as possible any ransomware being delivered through my mail server - and yes I'm already using that kind of ...
3
votes
2answers
205 views

Ransomware left some files not encrypted

A ransomware attack happened to my server, I've backups and all and I tracked down the reason to two elements (either unupdated Bitnami LAMP stack or unupdated Flask server) but I noticed some files ...
1
vote
2answers
948 views

How did Wanna Cry get past Antivirus Programs

For those who had windows computers when the WannaCry virus hit, how exactly did the virus bypass antivirus programs. I have tried to read some papers about this, but I don't understand how exactly ...
7
votes
8answers
14k views

MacOS Ransomware with EFI Lock

Problem Description Yesterday my mother called me that she got a message on her iPhone, that it was stolen (iCloud Find My Phone). She then had to enter security codes (two-factor authentication) ...
2
votes
1answer
153 views

Is it possible to “steal” someone else's ransomware bitcoin payment? [closed]

I'm not too sure if this belongs on security.SE, so feel free to close or migrate to a different SE. It seems that many ransomwares use Bitcoin as currency (for good reason), and tell you to send X ...
14
votes
3answers
3k views

Why does Sage Ransomeware blacklist League of Legends, steamapps, etc.? [closed]

I was recently reading the Malwarebytes Labs threat analysis for Sage Ransomware. I found it interesting to learn that, apparently, in addition to system directories, which makes sense, paths to games ...
0
votes
2answers
163 views

How files of ransom attacks were decypted?

In this site is was announced that everybody can decrypt the files victim of a ransom attack. They just don't tell you how it was possible. It's supposed the files were encrypted with an encryption ...
3
votes
0answers
53 views

Possible EternalBlue Infection, Next Step? [duplicate]

Sorry if I messed up in any manner, e.g. title, details, tags, layout, venue, response plan, etc. I know a little of the stacks and security in general. Short Version: I found material on my other ...
0
votes
1answer
147 views

Why does a perfc file cure/kill Petya ransomware (is it a bug or a deliberate decision of the creators)?

Why does a perfc file in the Windows directory prevent the recent Petya ransomware? Is it a bug in the ransomware that halt's it from executing? Or is it a deliberate attempt of the creators to allow ...