Questions tagged [ransomware]

Ransomware is a lethal kind of Malware that Encrypts your harddrive(s) and holds them hostage, providing the decryption key if you pay the hostage-taker(s) money (well-known variants are the FBI Virus and the Police Virus).

Filter by
Sorted by
Tagged with
1
vote
1answer
92 views

Can Android 5's own device encryption mechanism be exploited by a malware?

My wife's phone can't boot into android and instead displays a message that encryption has failed and all data is lost. She did not start the encryption process by herself. Now my question is: can ...
-1
votes
1answer
227 views

I have been attacked with a ransomeware, with all my files converted into .besub extension [closed]

I have been attacked with a ransom malware, with all my files converted into .besub extension. And the hacker left a note and asking for ransom. Obviously the data is important and I want it back. ...
0
votes
1answer
130 views

Is it possible to provide malware from a router?

I received a disturbing mail containing the password for my desktop computer account. In this mail the hacker stated that he used a vulnerability in my router with CVE: CVE-2020-1672. After searching ...
69
votes
4answers
15k views

Why is so much ransomware breakable?

The site: https://www.nomoreransom.org/ offers many decrypter tools for ransomware. But why? It shouldn't be so hard to use the Windows Crypto API (e.g. just google "create AES Key in Windows") to ...
-4
votes
1answer
64 views

After have all the Patches, NotPetya can still run? [closed]

NotPetya runs inmediatly after infection or can be there and being executed even do i have all the security patches?
165
votes
4answers
39k views

GitLab account hacked and repo wiped

I was working on a project, a private repo, and suddenly all the commits disappeared and were replaced with a single text file saying To recover your lost code and avoid leaking it: Send us 0.1 ...
0
votes
1answer
77 views

micro segmentation in the campus [closed]

We have so many devices (IoT and wintel, macs, androids, ios) spread across a few VLANs. Worried about any one device getting affected (e.g. Ransomware) and potentially infecting all other devices on ...
1
vote
2answers
106 views

Is VPN a likely access point through which to deploy a ransomware payload?

We run a small office network with Windows SBS 2011 and Draytek Vigor 3300 router. We recently had a ransomware attack in which it currently appears the payload was run on the SBS server itself. ...
0
votes
1answer
185 views

Ransomware on Mycloud NAS

I own a Mycloud NAS and it was affected by ransomware. In the NAS there are several folders, most of them are password protected. There is also the "Public" folder which can be seen by all users and ...
0
votes
1answer
148 views

Why doesn't WannaCry ask to “make changes to this computer” when you run the exe? [duplicate]

When you click on WannaCry, why doesn't it ask "do you want the following program to make changes to your computer?" I've watched videos of people running wannaCry, and it doesn't. I've also watched ...
0
votes
1answer
120 views

Can ransomware virus be removed from an affected PC? [duplicate]

I have had a ransomware attack that has only encrypted some files. Is there any way to find the virus and prevent it from encrypting more files?
0
votes
0answers
69 views

.[fileslocker@pm.me] virus [duplicate]

I have one PC (Windows 7) which is attacked presumably by a ransomware (in spite of having regularly updated antivirus viz Net Protector AV). What I could see is this -- In MySQL/bin folder, all files ...
2
votes
1answer
202 views

Ransomware - All computers infected but one

Let's say there is a particular network which has a "monthly" successful cryptolocker attack. Every time, every computer in that network is infected. The set up is like this: 1x Windows 2003 server (...
1
vote
0answers
126 views

How to prevent the ransomware to run with administrator privileges?

We have been attacked by the ransomware recently (adobe li). The strange thing is that ransomware was able to gain unimaginable high privileges. The virus of the ransomware has been located on the ...
1
vote
1answer
237 views

I found an RSA private key on my ransomware-infected device. Can I use it to decrypt the files?

I have ransomware on my laptop. I ran Spyhunter and deleted as much as I could. I found an RSA in the Windows registry with regedit. Then, as I was checking for unknown files, I found a .android file ...
4
votes
2answers
134 views

Will enabling SMB protocol authentication prevent Ransomware attack like WannaCry spreading in network?

We have a requirement of using SMB protocol due to a system limitation. will enabling SMB authentication among the nodes will prevent the ransomware threat spreading in network? Reference: https://...
-1
votes
2answers
130 views

Ransomware that attacks only mapped drives

Is it possible that ransomware attacks only mapped drives and not the local drive?
2
votes
0answers
2k views

Ransomware with .adobe extension

It is possible to decrypt file with .adobe extension ? File after encryption look like this : filename.id-5735353.[email@example.com].adobe . I did a little research and found information about "....
-1
votes
1answer
88 views

Online traffic monitoring by ISP for safety purposes [closed]

I have a question regarding approach to online security and protection against viruses, malware and phishing by one of the biggest European ISP. Below you will find my understanding of the topic. Is ...
2
votes
1answer
251 views

prevent Ransomware on CIFS shares mounted on Windows 10

I am using Windows 10 with Defender. I follow all the ground rules when dealing with the internet and staying secure. I work in IS so I'm pretty familiar with the various threat-vectors and do a good ...
2
votes
1answer
215 views

Dropbox ransomware experience

How Dropbox handles ransomware issues? Can it effectively restore files encrypted by ransomware? The reason I am asking is because I am looking for a bullet-proof solution against ransomware and ...
2
votes
1answer
136 views

Is this ransomware encryption or file corruption?

I have backups of a user folder from an older drive that I am getting to organizing now and noticed files are either corrupted or encrypted. File extensions and names are not changed, appears exe ...
1
vote
2answers
269 views

Is this a virus or what? DECRYPT_INFORMATION

On my computer there are lots of html files with titles DECRYPT_INFORMATION. I have scanned them with AVG and it says they are no threat but I am suspicious. I don't know html so when I open them on ...
2
votes
1answer
206 views

How does Ransomware use vssadmin.exe with admin privileges

I am doing some research about Ransomware and their methods. In many articles they write that the ransomware performs vssadmin.exe to delete shadow copys. And I found following Information about how ...
2
votes
1answer
1k views

How dangerous is SMBv1?

I have a NAS (network disk) from Zylex which stopped working under Windows 10 a while ago. Investigation shows that it uses SMBv1, which was implicated in several ransomware attacks and was therefore ...
0
votes
1answer
186 views

Will re-imaging kill ransomware?

Pretty much what the title suggests. I understand its quite vague so apologies. I'm just not sure if it's able to install something that will sit elsewhere on the machine (as in not on the C:) which ...
4
votes
1answer
521 views

Received an email from a Bulgarian address trying to extort money

As the title says, I received an email from some Bulgarian email address saying that the sender has compromised my browser and thereby obtained control over my camera as well as gathering data on all ...
4
votes
1answer
305 views

Reality Check: Create chaos at an office

An opportunity has arisen for me to perform a "real hacking attack" on a TV show. The target is to attack the TV headquarters and cause as much chaos as possible. The idea is to show how a business ...
1
vote
2answers
1k views

Why does WannaCry encrypt symmetric key with a new per-victim-only public key?

According to this answer, WannaCry will: Generate AES key at victim's system to encrypt victim's files. Generate RSA key at victim's system to encrypt AES key generated above. Encrypt private key of ...
3
votes
3answers
495 views

How to prove a false positive

I was notified by my university's infosec team that one of my lab's computers had been infected by ransomware. They shut down the computer's network connections using Crowdstrike and are insisting ...
6
votes
1answer
601 views

Why does WannaCry use different AES keys to encrypt different files on host?

I have a question after reading the discussion here: Ransomware encryption keys So I understand the process of WannaCry encryption now, thanks to the accepted answer given by the community on the ...
-1
votes
1answer
100 views

How to find which program encrypted my files? [closed]

I've been infected by a ransomware and all files have extension .lin. how can i find the program that encrypted my files ?
2
votes
2answers
200 views

Why cant i run malware in my Virtual Environment

Im trying to run some malware samples in my Virtual lab to capture their IOC's. Im doing this for my Masters Thesis but i can not seem to get the malware to run. I have downloaded samples from hybrid ...
4
votes
1answer
138 views

How to combat Doxware?

There is seemingly very little information available about the emergence of ransomware; doxware. I could only find a couple of news articles suggesting that doxware encrypts your files, but also ...
-2
votes
1answer
161 views

Can Ransomware impersonate a Windows Domain Account?

Ransomware (Globe Imposter) was found on one of our production servers. The executable was found in the documents folder of one of our employees on the same server. A Windows Scheduled Task was also ...
1
vote
1answer
2k views

Dharma ransomeware files decryption [closed]

One of my clients send me some picture that shows they infected by some ransomware. As i analysed i found that ransomware is probably Dharma ransomware, child of Crysis. so i tried to decrypt files ...
2
votes
0answers
211 views

How to implement a Crysis ransomware master key?

I see there have been master keys released to decrypt computers affected by the Crysis ransomware. If a computer is infected with Crysis, how would one actually test/run the key on the computer? ...
2
votes
2answers
297 views

Is this Backup Safe from Ransomware?

I'm planning a home backup setup, and I'm not sure if I really understand this quite right. The idea is I'll set up a Linux server on the network that contains two drives. Drive1 will be network-...
1
vote
1answer
347 views

Why do some ransomware executables run on VirtualBox? [closed]

Even though they appears to have anti-VM capabilities? I've downloaded some latest samples of ransomware executables from cerber, locky, and other family of ransomware Why do they still execute in ...
0
votes
1answer
67 views

Finding/Predicting BotNet Generated Domains Without DGA Knowledge

I will pose an academic perspective in my question, but I welcome any and every observation. So a botnet would generate 1000s of domain/day and an actual attacker will register a few, which will be ...
2
votes
4answers
183 views

Why is phishing becoming synonymous with ransomware?

The Wikipedia definition of phishing is: the fraudulent practice of sending emails purporting to be from reputable companies in order to induce individuals to reveal personal information, such as ...
5
votes
2answers
636 views

Are we safe from infection of Bad Rabbit?

I'm doing an assessment on the potential outspread of Bad Rabbit in our organization. Our staff do not have admin privileges on their host machines. We have also blocked the IOCs. Am I safe to say ...
4
votes
1answer
252 views

How do I use google drive local folder with auto sync while protecting myself from ransomware?

Background So I have my Google Drive 1TB account. Obviously, I'm using Drive to have a backup for all my precious files. I used to have a local Drive folder with auto sync on my PC. It was very ...
0
votes
1answer
103 views

Ransom-ware nuclear. how did it get into my pc? [closed]

Got infected, it happened as i was sitting on the PC (Windows 10), i noticed a slow-down and one of the external disks had high activity, upon inspection noticed some files had the .nuclear extension. ...
1
vote
1answer
446 views

Information on cryptolocker seeking ransom via email to certain email address

A friend of mine was recently attacked by this new cryptolocker in an unusual way. I anticipate my question: what kind of cryptolocker is this, what could the attack vector be, and is a cure available ...
3
votes
1answer
4k views

WannaCry Source Code

Maybe this is a stupid question: Is the WannaCry source code public? https ://github.com/svenvdz/wannacry https: //github.com/Hackstar7/WanaCry https: //github.com/fadyosman/WannaCrySample I didn'...
3
votes
1answer
816 views

Can you find the ransomware key if you already have decrypted files?

Disclaimer: I have very very little experience with ransomware/encryption, so I'm sorry if I ask something stupid. Ransomware attacks are all over the news, especially this year. And this got me ...
5
votes
5answers
255 views

In the era of cryptolockers, is it possible to prevent Windows from modifying your Linux partition?

I could imagine that in few years, cryptolockers could become so advanced that instead of just encrypting some files on the partition of the current OS, they could also touch all other partitions on ...
1
vote
4answers
281 views

How can I defend my mail server against ransomware?

First of all I'm aware that I should use some anti-virus mechanism to prevent as much as possible any ransomware being delivered through my mail server - and yes I'm already using that kind of ...
3
votes
2answers
230 views

Ransomware left some files not encrypted

A ransomware attack happened to my server, I've backups and all and I tracked down the reason to two elements (either unupdated Bitnami LAMP stack or unupdated Flask server) but I noticed some files ...