Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
Make your voice heard. Take the 2019 Developer Survey now

Questions tagged [ransomware]

Ransomware is a lethal kind of Malware that Encrypts your harddrive(s) and holds them hostage, providing the decryption key if you pay the hostage-taker(s) money (well-known variants are the FBI Virus and the Police Virus).

0
votes
1answer
80 views

Can ransomware virus be removed from an affected PC? [duplicate]

I have had a ransomware attack that has only encrypted some files. Is there any way to find the virus and prevent it from encrypting more files?
0
votes
0answers
60 views

.[fileslocker@pm.me] virus [duplicate]

I have one PC (Windows 7) which is attacked presumably by a ransomware (in spite of having regularly updated antivirus viz Net Protector AV). What I could see is this -- In MySQL/bin folder, all files ...
1
vote
1answer
107 views

Ransomware - All computers infected but one

Let's say there is a particular network which has a "monthly" successful cryptolocker attack. Every time, every computer in that network is infected. The set up is like this: 1x Windows 2003 server (...
1
vote
0answers
54 views

How to prevent the ransomware to run with administrator privileges?

We have been attacked by the ransomware recently (adobe li). The strange thing is that ransomware was able to gain unimaginable high privileges. The virus of the ransomware has been located on the ...
1
vote
1answer
133 views

I found an RSA private key on my ransomware-infected device. Can I use it to decrypt the files?

I have ransomware on my laptop. I ran Spyhunter and deleted as much as I could. I found an RSA in the Windows registry with regedit. Then, as I was checking for unknown files, I found a .android file ...
4
votes
2answers
65 views

Will enabling SMB protocol authentication prevent Ransomware attack like WannaCry spreading in network?

We have a requirement of using SMB protocol due to a system limitation. will enabling SMB authentication among the nodes will prevent the ransomware threat spreading in network? Reference: https://...
-1
votes
2answers
66 views

Ransomware that attacks only mapped drives

Is it possible that ransomware attacks only mapped drives and not the local drive?
2
votes
0answers
2k views

Ransomware with .adobe extension

It is possible to decrypt file with .adobe extension ? File after encryption look like this : filename.id-5735353.[email@example.com].adobe . I did a little research and found information about "....
-1
votes
1answer
58 views

Online traffic monitoring by ISP for safety purposes [closed]

I have a question regarding approach to online security and protection against viruses, malware and phishing by one of the biggest European ISP. Below you will find my understanding of the topic. Is ...
2
votes
1answer
77 views

prevent Ransomware on CIFS shares mounted on Windows 10

I am using Windows 10 with Defender. I follow all the ground rules when dealing with the internet and staying secure. I work in IS so I'm pretty familiar with the various threat-vectors and do a good ...
1
vote
1answer
113 views

Dropbox ransomware experience

How Dropbox handles ransomware issues? Can it effectively restore files encrypted by ransomware? The reason I am asking is because I am looking for a bullet-proof solution against ransomware and ...
2
votes
1answer
127 views

Is this ransomware encryption or file corruption?

I have backups of a user folder from an older drive that I am getting to organizing now and noticed files are either corrupted or encrypted. File extensions and names are not changed, appears exe ...
1
vote
2answers
221 views

Is this a virus or what? DECRYPT_INFORMATION

On my computer there are lots of html files with titles DECRYPT_INFORMATION. I have scanned them with AVG and it says they are no threat but I am suspicious. I don't know html so when I open them on ...
2
votes
1answer
92 views

How does Ransomware use vssadmin.exe with admin privileges

I am doing some research about Ransomware and their methods. In many articles they write that the ransomware performs vssadmin.exe to delete shadow copys. And I found following Information about how ...
0
votes
0answers
112 views

Can WannaCry infect my local network and its devices?

So long story short I wanted to test out WannaCry on my Windows 7 guest machine, thing is I forgot to disable the network connection / interface in virtualbox and ran it. Only seconds later I realized ...
1
vote
1answer
450 views

How dangerous is SMBv1?

I have a NAS (network disk) from Zylex which stopped working under Windows 10 a while ago. Investigation shows that it uses SMBv1, which was implicated in several ransomware attacks and was therefore ...
0
votes
1answer
145 views

Will re-imaging kill ransomware?

Pretty much what the title suggests. I understand its quite vague so apologies. I'm just not sure if it's able to install something that will sit elsewhere on the machine (as in not on the C:) which ...
3
votes
1answer
378 views

Received an email from a Bulgarian address trying to extort money

As the title says, I received an email from some Bulgarian email address saying that the sender has compromised my browser and thereby obtained control over my camera as well as gathering data on all ...
4
votes
1answer
286 views

Reality Check: Create chaos at an office

An opportunity has arisen for me to perform a "real hacking attack" on a TV show. The target is to attack the TV headquarters and cause as much chaos as possible. The idea is to show how a business ...
1
vote
2answers
707 views

Why does WannaCry encrypt symmetric key with a new per-victim-only public key?

According to this answer, WannaCry will: Generate AES key at victim's system to encrypt victim's files. Generate RSA key at victim's system to encrypt AES key generated above. Encrypt private key of ...
3
votes
3answers
330 views

How to prove a false positive

I was notified by my university's infosec team that one of my lab's computers had been infected by ransomware. They shut down the computer's network connections using Crowdstrike and are insisting ...
0
votes
0answers
62 views

How to protect Windows 10 network backup against ransomware (cryptolock) by removing permissions on NAS

Windows backup has files structure like this: Backup set directory: Backup files directory: I am considering protecting network backup by periodical removing write permission to already uploaded ...
6
votes
1answer
467 views

Why does WannaCry use different AES keys to encrypt different files on host?

I have a question after reading the discussion here: Ransomware encryption keys So I understand the process of WannaCry encryption now, thanks to the accepted answer given by the community on the ...
-1
votes
1answer
90 views

How to find which program encrypted my files? [closed]

I've been infected by a ransomware and all files have extension .lin. how can i find the program that encrypted my files ?
3
votes
2answers
151 views

Why cant i run malware in my Virtual Environment

Im trying to run some malware samples in my Virtual lab to capture their IOC's. Im doing this for my Masters Thesis but i can not seem to get the malware to run. I have downloaded samples from hybrid ...
4
votes
1answer
112 views

How to combat Doxware?

There is seemingly very little information available about the emergence of ransomware; doxware. I could only find a couple of news articles suggesting that doxware encrypts your files, but also ...
-3
votes
1answer
134 views

Can Ransomware impersonate a Windows Domain Account?

Ransomware (Globe Imposter) was found on one of our production servers. The executable was found in the documents folder of one of our employees on the same server. A Windows Scheduled Task was also ...
1
vote
1answer
2k views

Dharma ransomeware files decryption [closed]

One of my clients send me some picture that shows they infected by some ransomware. As i analysed i found that ransomware is probably Dharma ransomware, child of Crysis. so i tried to decrypt files ...
2
votes
0answers
196 views

How to implement a Crysis ransomware master key?

I see there have been master keys released to decrypt computers affected by the Crysis ransomware. If a computer is infected with Crysis, how would one actually test/run the key on the computer? ...
2
votes
2answers
257 views

Is this Backup Safe from Ransomware?

I'm planning a home backup setup, and I'm not sure if I really understand this quite right. The idea is I'll set up a Linux server on the network that contains two drives. Drive1 will be network-...
1
vote
1answer
232 views

Why do some ransomware executables run on VirtualBox? [closed]

Even though they appears to have anti-VM capabilities? I've downloaded some latest samples of ransomware executables from cerber, locky, and other family of ransomware Why do they still execute in ...
0
votes
1answer
59 views

Finding/Predicting BotNet Generated Domains Without DGA Knowledge

I will pose an academic perspective in my question, but I welcome any and every observation. So a botnet would generate 1000s of domain/day and an actual attacker will register a few, which will be ...
2
votes
4answers
174 views

Why is phishing becoming synonymous with ransomware?

The Wikipedia definition of phishing is: the fraudulent practice of sending emails purporting to be from reputable companies in order to induce individuals to reveal personal information, such as ...
5
votes
2answers
628 views

Are we safe from infection of Bad Rabbit?

I'm doing an assessment on the potential outspread of Bad Rabbit in our organization. Our staff do not have admin privileges on their host machines. We have also blocked the IOCs. Am I safe to say ...
4
votes
1answer
215 views

How do I use google drive local folder with auto sync while protecting myself from ransomware?

Background So I have my Google Drive 1TB account. Obviously, I'm using Drive to have a backup for all my precious files. I used to have a local Drive folder with auto sync on my PC. It was very ...
0
votes
1answer
99 views

Ransom-ware nuclear. how did it get into my pc? [closed]

Got infected, it happened as i was sitting on the PC (Windows 10), i noticed a slow-down and one of the external disks had high activity, upon inspection noticed some files had the .nuclear extension. ...
4
votes
1answer
3k views

WannaCry Source Code

Maybe this is a stupid question: Is the WannaCry source code public? https ://github.com/svenvdz/wannacry https: //github.com/Hackstar7/WanaCry https: //github.com/fadyosman/WannaCrySample I didn'...
3
votes
1answer
637 views

Can you find the ransomware key if you already have decrypted files?

Disclaimer: I have very very little experience with ransomware/encryption, so I'm sorry if I ask something stupid. Ransomware attacks are all over the news, especially this year. And this got me ...
5
votes
5answers
243 views

In the era of cryptolockers, is it possible to prevent Windows from modifying your Linux partition?

I could imagine that in few years, cryptolockers could become so advanced that instead of just encrypting some files on the partition of the current OS, they could also touch all other partitions on ...
1
vote
4answers
250 views

How can I defend my mail server against ransomware?

First of all I'm aware that I should use some anti-virus mechanism to prevent as much as possible any ransomware being delivered through my mail server - and yes I'm already using that kind of ...
3
votes
2answers
199 views

Ransomware left some files not encrypted

A ransomware attack happened to my server, I've backups and all and I tracked down the reason to two elements (either unupdated Bitnami LAMP stack or unupdated Flask server) but I noticed some files ...
1
vote
2answers
856 views

How did Wanna Cry get past Antivirus Programs

For those who had windows computers when the WannaCry virus hit, how exactly did the virus bypass antivirus programs. I have tried to read some papers about this, but I don't understand how exactly ...
7
votes
8answers
14k views

MacOS Ransomware with EFI Lock

Problem Description Yesterday my mother called me that she got a message on her iPhone, that it was stolen (iCloud Find My Phone). She then had to enter security codes (two-factor authentication) ...
2
votes
1answer
151 views

Is it possible to “steal” someone else's ransomware bitcoin payment? [closed]

I'm not too sure if this belongs on security.SE, so feel free to close or migrate to a different SE. It seems that many ransomwares use Bitcoin as currency (for good reason), and tell you to send X ...
14
votes
3answers
3k views

Why does Sage Ransomeware blacklist League of Legends, steamapps, etc.? [closed]

I was recently reading the Malwarebytes Labs threat analysis for Sage Ransomware. I found it interesting to learn that, apparently, in addition to system directories, which makes sense, paths to games ...
0
votes
2answers
161 views

How files of ransom attacks were decypted?

In this site is was announced that everybody can decrypt the files victim of a ransom attack. They just don't tell you how it was possible. It's supposed the files were encrypted with an encryption ...
3
votes
0answers
53 views

Possible EternalBlue Infection, Next Step? [duplicate]

Sorry if I messed up in any manner, e.g. title, details, tags, layout, venue, response plan, etc. I know a little of the stacks and security in general. Short Version: I found material on my other ...
0
votes
1answer
126 views

Why does a perfc file cure/kill Petya ransomware (is it a bug or a deliberate decision of the creators)?

Why does a perfc file in the Windows directory prevent the recent Petya ransomware? Is it a bug in the ransomware that halt's it from executing? Or is it a deliberate attempt of the creators to allow ...
2
votes
4answers
171 views

Archival storage for ransomware defense

Thinking about the threat posed by ransomware, the defense that makes the most sense to me is to have a secure copy, and an automated way to restore protected files. Ordinary backups are not really ...
2
votes
2answers
485 views

Can the new WannaCry affect Linux ext4 file system data from Windows?

So every now and then I switch over to my Windows 10 OS from my Linux partition. Whilst I am there, I am fully aware that I can be infected with WannaCry which will encrypt all the files on the system....