Questions tagged [ransomware]

Ransomware is a lethal kind of Malware that Encrypts your harddrive(s) and holds them hostage, providing the decryption key if you pay the hostage-taker(s) money (well-known variants are the FBI Virus and the Police Virus).

Filter by
Sorted by
Tagged with
0
votes
0answers
46 views

Barabasz.one backdoor virus? [closed]

I've found weird virus online, it was the first time I have ever seen that form. It was presented as 'shortcut': C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy ...
2
votes
1answer
226 views

Ransomware - All computers infected but one

Let's say there is a particular network which has a "monthly" successful cryptolocker attack. Every time, every computer in that network is infected. The set up is like this: 1x Windows 2003 server (...
0
votes
1answer
233 views

Ransomware on Mycloud NAS

I own a Mycloud NAS and it was affected by ransomware. In the NAS there are several folders, most of them are password protected. There is also the "Public" folder which can be seen by all users and ...
1
vote
1answer
64 views

What is the industry best practice for when 3rd parties are hit with ransomware? [closed]

I am interested to know if anyone has experienced this, what was the response and more importantly, is there best practices to handle these situations? My organization recently had a case where one ...
0
votes
1answer
73 views

Will this Setup Protect My Data Files from Malware (e.g. Ransomware)?

I set up an external drive for data backup (an SD card inside my laptop card slot). In addition, I connect with a cloud drive for offsite backup (an app that I run only when syncing files). I always ...
-2
votes
1answer
138 views

How should we deal with ransomware after it did happend? [closed]

I am trying to explain what happened and asking what could be done after being infected Yesterday a client called and told me something strange happened to his server and most of the file types are ...
1
vote
4answers
196 views

Ransomware aversion and identification techniques

I don't think there's a need to go into the background here, but identification of the process may be better explored. From a developer pov, at a high level, the files are modified, by virtue of the ...
0
votes
1answer
99 views

How to remove STOP Ransomware

Guys hello. One of my friend laptop get infected with STOP ransomware, all files are encrypted with .mosk extension.The admin account of machine is also compromised, we tried to install emisoft ...
67
votes
3answers
13k views

How does ransomware get the permissions to encrypt your disk?

Recently, my employer blocked access to Gmail, Yahoo Mail, etc., because an employee downloaded an email attachment which contained ransomware and got their disk encrypted. QUESTION : How does ...
3
votes
2answers
3k views

Can ransomware encrypt files in a drive locked by BitLocker?

I have a general understanding of how ransomware works. I want to know if ransomware will target a locked Bitlocker drive, however. I very rarely unlock that drive, and it will only be unlocked for ...
0
votes
1answer
65 views

Are my personal files safe from BORA ramsomware if I have set them to 'read only'?

A friend's PC got infected with BORA ransomware 2 days ago and I was wandering if his files would have been encrypted if he had made them 'read only' before the ransomware had struck. Is it possible ...
1
vote
1answer
96 views

Can Android 5's own device encryption mechanism be exploited by a malware?

My wife's phone can't boot into android and instead displays a message that encryption has failed and all data is lost. She did not start the encryption process by herself. Now my question is: can ...
-1
votes
1answer
248 views

I have been attacked with a ransomeware, with all my files converted into .besub extension [closed]

I have been attacked with a ransom malware, with all my files converted into .besub extension. And the hacker left a note and asking for ransom. Obviously the data is important and I want it back. ...
0
votes
1answer
149 views

Is it possible to provide malware from a router?

I received a disturbing mail containing the password for my desktop computer account. In this mail the hacker stated that he used a vulnerability in my router with CVE: CVE-2020-1672. After searching ...
67
votes
4answers
15k views

Why is so much ransomware breakable?

The site: https://www.nomoreransom.org/ offers many decrypter tools for ransomware. But why? It shouldn't be so hard to use the Windows Crypto API (e.g. just google "create AES Key in Windows") to ...
166
votes
4answers
39k views

GitLab account hacked and repo wiped

I was working on a project, a private repo, and suddenly all the commits disappeared and were replaced with a single text file saying To recover your lost code and avoid leaking it: Send us 0.1 ...
-4
votes
1answer
65 views

After have all the Patches, NotPetya can still run? [closed]

NotPetya runs inmediatly after infection or can be there and being executed even do i have all the security patches?
4
votes
2answers
537 views

Would limiting write access to a backup directory help protect it from ransomware?

I know that this is similar to this question, but I don't believe it's a duplicate. You have a program that automatically makes regular backups of all your files to a folder or mounted drive. Let's ...
1
vote
2answers
111 views

Is VPN a likely access point through which to deploy a ransomware payload?

We run a small office network with Windows SBS 2011 and Draytek Vigor 3300 router. We recently had a ransomware attack in which it currently appears the payload was run on the SBS server itself. ...
3
votes
3answers
644 views

How can I protect myself from “ransomware” attacks like the one that affected Transmission users?

The downloader for version 2.90 of the Transmission BitTorrent client was infected by a piece of malware called KeRanger, which encrypts files on your computer and demands a one-Bitcoin ransom to ...
0
votes
1answer
96 views

micro segmentation in the campus [closed]

We have so many devices (IoT and wintel, macs, androids, ios) spread across a few VLANs. Worried about any one device getting affected (e.g. Ransomware) and potentially infecting all other devices on ...
39
votes
2answers
9k views

How can ransomware be so prevalent when there is such a clear money trail to the attackers?

If there's one thing the Internet is good at, it's keeping track money and knowing where it has moved. Ransomware attacks typically request payment for a decryption key. How is it with such an easily ...
1
vote
1answer
459 views

Information on cryptolocker seeking ransom via email to certain email address

A friend of mine was recently attacked by this new cryptolocker in an unusual way. I anticipate my question: what kind of cryptolocker is this, what could the attack vector be, and is a cure available ...
0
votes
1answer
152 views

Why doesn't WannaCry ask to “make changes to this computer” when you run the exe? [duplicate]

When you click on WannaCry, why doesn't it ask "do you want the following program to make changes to your computer?" I've watched videos of people running wannaCry, and it doesn't. I've also watched ...
0
votes
1answer
207 views

Will re-imaging kill ransomware?

Pretty much what the title suggests. I understand its quite vague so apologies. I'm just not sure if it's able to install something that will sit elsewhere on the machine (as in not on the C:) which ...
0
votes
1answer
137 views

Can ransomware virus be removed from an affected PC? [duplicate]

I have had a ransomware attack that has only encrypted some files. Is there any way to find the virus and prevent it from encrypting more files?
0
votes
0answers
77 views

.[fileslocker@pm.me] virus [duplicate]

I have one PC (Windows 7) which is attacked presumably by a ransomware (in spite of having regularly updated antivirus viz Net Protector AV). What I could see is this -- In MySQL/bin folder, all files ...
1
vote
0answers
173 views

How to prevent the ransomware to run with administrator privileges?

We have been attacked by the ransomware recently (adobe li). The strange thing is that ransomware was able to gain unimaginable high privileges. The virus of the ransomware has been located on the ...
1
vote
1answer
283 views

I found an RSA private key on my ransomware-infected device. Can I use it to decrypt the files?

I have ransomware on my laptop. I ran Spyhunter and deleted as much as I could. I found an RSA in the Windows registry with regedit. Then, as I was checking for unknown files, I found a .android file ...
4
votes
2answers
163 views

Will enabling SMB protocol authentication prevent Ransomware attack like WannaCry spreading in network?

We have a requirement of using SMB protocol due to a system limitation. will enabling SMB authentication among the nodes will prevent the ransomware threat spreading in network? Reference: https://...
2
votes
0answers
2k views

Ransomware with .adobe extension

It is possible to decrypt file with .adobe extension ? File after encryption look like this : filename.id-5735353.[email@example.com].adobe . I did a little research and found information about "....
-1
votes
2answers
184 views

Ransomware that attacks only mapped drives

Is it possible that ransomware attacks only mapped drives and not the local drive?
-1
votes
1answer
108 views

Online traffic monitoring by ISP for safety purposes [closed]

I have a question regarding approach to online security and protection against viruses, malware and phishing by one of the biggest European ISP. Below you will find my understanding of the topic. Is ...
2
votes
1answer
361 views

prevent Ransomware on CIFS shares mounted on Windows 10

I am using Windows 10 with Defender. I follow all the ground rules when dealing with the internet and staying secure. I work in IS so I'm pretty familiar with the various threat-vectors and do a good ...
2
votes
1answer
272 views

Dropbox ransomware experience

How Dropbox handles ransomware issues? Can it effectively restore files encrypted by ransomware? The reason I am asking is because I am looking for a bullet-proof solution against ransomware and ...
245
votes
10answers
82k views

How is the “WannaCry” Malware spreading and how should users defend themselves from it?

There's a new strain of attacks which is affecting a lot of systems around the world (including the NHS in the UK and Telefonica in Spain) which is being called "WannaCry" amongst other names. It ...
4
votes
1answer
547 views

Received an email from a Bulgarian address trying to extort money

As the title says, I received an email from some Bulgarian email address saying that the sender has compromised my browser and thereby obtained control over my camera as well as gathering data on all ...
2
votes
1answer
142 views

Is this ransomware encryption or file corruption?

I have backups of a user folder from an older drive that I am getting to organizing now and noticed files are either corrupted or encrypted. File extensions and names are not changed, appears exe ...
1
vote
2answers
286 views

Is this a virus or what? DECRYPT_INFORMATION

On my computer there are lots of html files with titles DECRYPT_INFORMATION. I have scanned them with AVG and it says they are no threat but I am suspicious. I don't know html so when I open them on ...
2
votes
1answer
253 views

How does Ransomware use vssadmin.exe with admin privileges

I am doing some research about Ransomware and their methods. In many articles they write that the ransomware performs vssadmin.exe to delete shadow copys. And I found following Information about how ...
6
votes
1answer
649 views

Why does WannaCry use different AES keys to encrypt different files on host?

I have a question after reading the discussion here: Ransomware encryption keys So I understand the process of WannaCry encryption now, thanks to the accepted answer given by the community on the ...
19
votes
1answer
7k views

Ransomware encryption keys

Where does ransomware such as the recent wannacry variant store the key it uses to encrypt the files on the victim's disk? Is this hard coded in the program itself? Or does it call into a server to ...
2
votes
1answer
1k views

How dangerous is SMBv1?

I have a NAS (network disk) from Zylex which stopped working under Windows 10 a while ago. Investigation shows that it uses SMBv1, which was implicated in several ransomware attacks and was therefore ...
0
votes
0answers
670 views

How are ransomware keys found?

I'm familiar how ransomware works and how they encrypt the files. If the encryption is done by a public key only (which the private is saved at the attacker's server), you cannot decrypt those files ...
20
votes
5answers
5k views

Is there any open source ransomware? [closed]

I'm working on malware analysis at my university and I'm trying to develop ransomware. I'm planning to publish the source code after it's finished. Is there any open source ransomware sample so I can ...
4
votes
1answer
309 views

Reality Check: Create chaos at an office

An opportunity has arisen for me to perform a "real hacking attack" on a TV show. The target is to attack the TV headquarters and cause as much chaos as possible. The idea is to show how a business ...
6
votes
3answers
3k views

Ransomware-resilient Linux Samba file server

Imagine the following scenario: Files are kept on a Linux server and clients access them via Samba. One of the client machines gets infected with ransomware, which encrypts everything within the ...
1
vote
2answers
1k views

Why does WannaCry encrypt symmetric key with a new per-victim-only public key?

According to this answer, WannaCry will: Generate AES key at victim's system to encrypt victim's files. Generate RSA key at victim's system to encrypt AES key generated above. Encrypt private key of ...
1
vote
1answer
106 views

Backup to non-persistent mapped NAS

My backup mechanism until now is a batch file to copy my data folder to my NAS, which is permanently mapped as Drive N:. I have a batch file (BackShut.bat) which mirrors my data directory to the NAS ...
3
votes
3answers
533 views

How to prove a false positive

I was notified by my university's infosec team that one of my lab's computers had been infected by ransomware. They shut down the computer's network connections using Crowdstrike and are insisting ...