Questions tagged [ransomware]

Ransomware is a lethal kind of Malware that Encrypts your harddrive(s) and holds them hostage, providing the decryption key if you pay the hostage-taker(s) money (well-known variants are the FBI Virus and the Police Virus).

Filter by
Sorted by
Tagged with
6
votes
1answer
1k views

CryptoLocker master key

I am struggling to understand how it is possible to decrypt files encrypted by the TeslaCrypt ransomware using the master key their creators provided. As far as I know, ransomware encrypts files ...
-3
votes
1answer
2k views

SQL Server infected with Troldesh ransomware with DB backup files [closed]

The SQL server was infected by a ransomware virus. Files has been modified as FileName.7z.id-38199C3A.diablo_diablo2@aol.com. Unfortunately all the DB backup files were also stored on the C: drive. I ...
0
votes
1answer
126 views

What kind of damage does the HummingBad Android malware do when it fails to gain root access?

There is this Android virus out there called HummingBad, and it seems the first thing it tries to do is try to get root access. There are so many device models out there, and the rooting process is ...
1
vote
0answers
54 views

How can I find out which process was stopped by RansomWhere? [closed]

Edit: Since this question turned out to be off-topic here, I've re-posted it to Ask Different. I use RansomWhere, a tool to protect from ransomware. As far as I understand, RansomWhere just warns ...
1
vote
2answers
4k views

Protection from ransomware using virtual machine

I have been recently reading about rise in ransomware attacks such as CryptXXX and I was curious about I can protect myself from such attacks. I have a Windows 10 x64 system. Some measures I took are ...
1
vote
1answer
163 views

Security of a backup server

I am concerned about attacks of the crypto malware which encrypts all storage reachable (for a ransom payment you get the key to decrypt). I use only Linux (Debian) and have a separate ARM computer to ...
1
vote
2answers
371 views

Unencrypt Data Encrypted by Cryptolocker Virus [duplicate]

A while back my computer was encrypted by the cryptolocker virus. I ended up taking an image of the encrypted drive and then formatting it and installing a new operating system. Since I have the ...
3
votes
2answers
705 views

DGA (Domain Generation Algorithm) - malwares

Some malwares use DGA (Domain Generation Algorithm) to randomly generate domains in order for the zombies to be able to communicate in a resilient manner with the C&C. As far as I know, there is ...
4
votes
2answers
583 views

Ransom32: How does it work?

Ransom32 seems to be a new ransomware written (partly) in JavaScript. As I understand it, it doesn't affect a user through a browser / by visiting a website, but by downloading some .rar file which ...
3
votes
1answer
155 views

Is CryptoLocker part of the TeslaCrypt ransomware family?

I'm reading a Microsoft report examining the most prevalent ransomware families as of recent. On the news, I've heard of CryptoLocker, CryptoWall and TeslaCrypt, but I don't see any of them ...
-1
votes
2answers
167 views

Limit possible harm of ransomware on a fileserver

First to say: I know I need a backup and I have one of course but my question isn't about the safety of the data but about how to reduce the possible time that is needed to restore data. I'm already ...
4
votes
3answers
1k views

What is a good backup strategy against ransomware? [duplicate]

From my understanding, most ransomware works in the background until they are finished with encrypting all their chosen files. I assume that while the ransomware work in the background, if I plug in ...
2
votes
3answers
631 views

Is there now an increased risk of ransomware in pirated software?

Ransomware is on the rise, much due to new ransom-paying opportunities via Bitcoin. Has there been a reported increased risk of ransomware in pirated software (i.e. so called “warez”) – outside of ...
3
votes
1answer
543 views

Is there a ransomware variant that checks for file's magic numbers to encrypt?

Is there a known ransomware-variant (Cryptolocker, Cryptowall etc.) that before encrypting the files checks for their magic numbers? Lets say that there's a Word file, that had its file extension ...
7
votes
2answers
1k views

How to protect Time Machine backups from Ransomware?

According to Heise (German) Time Machine backups can be encrypted by Ransomware. Sorry I didn't find an English source, please use Google translate. KeRanger had an inactive module ...
0
votes
2answers
2k views

Ransomware doesn't change file extension after encryption

Today, one of my end users using Windows 7 (for reference) got infected with a ransomware variant that weirdly enough doesn't seem to have changed the files's extensions. Is this possible? Is there a ...
4
votes
3answers
934 views

Does typical Ransomware only 'attack' certain folders/filetypes

I expect this is very much on a per malware and OS basis so could potentially be very broad hence the typical. A user's computer has been infected by a piece of malware which aims to encrypt all ...
7
votes
3answers
4k views

Why aren't ransomware deployers arrested? [closed]

Why aren't people who use ransomware to extort money from people arrested? Using ransomware is illegal, presumably. The idea that Bitcoin is anonymous is a myth. Given this, it seems like they ...
1
vote
2answers
511 views

May I install more than one anti ransomware on the same pc?

I installed Bitdefender anti ransomware free tool, but as I read: It is only good against CryptoWall and CTB-Locker. So I'd like to install some others, but I wonder: Is it recommendable to ...
1
vote
2answers
494 views

The best way to prevent ransomware and virus? [closed]

I am using Avast free antivirus real time protection and weekly scan Malwarebytes free anti malware weekly scan Malwarebytes Anti-ransomware EMET good enough? Anything else I should do or choose ...
10
votes
2answers
1k views

Techniques to detect & mitigate Crypto-ransomware?

Crypto ransomware attacks are the latest concerns for our organization, we need to verify if we are adequately protected from them & if affected, what are the generic mitigation measure? How do ...
1
vote
2answers
281 views

Would a RansomWhere application be possible for Windows too?

This is related to RansomWhere? which is a OS X specific defense developed by a former NSA employee. The premise is that it will "generically" stop ransomware from encrypting files on the OS. ...
20
votes
2answers
3k views

Do the most common ransomware programs delete the original files as they go, or in a big bulk delete at the very end?

I'm talking about the most common varieties like Cryptolocker, Cryptowall, Torrentlocker, KeRanger, RSA4096, etc. (There is not necessarily a need to answer for all of these, one or two may do.) If ...
5
votes
3answers
572 views

Mitigating the risk for a successful ransomware infection

The company I work for has been getting hit with loads and loads of frightfully sophisticated ransomware spam lately, people masking as consultants, customers, very specific company requests, etc. ...
4
votes
2answers
514 views

Would limiting write access to a backup directory help protect it from ransomware?

I know that this is similar to this question, but I don't believe it's a duplicate. You have a program that automatically makes regular backups of all your files to a folder or mounted drive. Let's ...
1
vote
3answers
134 views

Why aren't hardware R/W switches used to defend hard drives?

ISTR back in the early days of (build your own) PCs having an old 486 PC with two hard drives, and hacking the "Turbo" switch on the front panel (remember those?) to be a read-protect switch for ...
4
votes
1answer
299 views

Can ransomware hide in cloud storage/backup environments?

I currently use Dropbox as an online backup to protect my important files (work related, save files, some hobby projects) against data loss, including ransomware, hardware loss, theft,... However, I'...
71
votes
15answers
28k views

Are cloud storage services a good strategy to protect against ransomware attacks?

I have been reading a lot here about Ransomware attacks and I am wondering if my strategy for protecting myself is valid or not. I have 10Gb of personal data and 90Gb of photos and videos. I have ...
198
votes
10answers
24k views

What should you do if you catch encryption ransomware mid-operation?

You boot up your computer one day and while using it you notice that your drive is unusually busy. You check the System Monitor and notice that an unknown process is using the CPU and both reading and ...
2
votes
1answer
980 views

How does the MFT encryption work?

A few week ago there was a ransomware called Petya delivered via Dropbox links. The new ransomware is inserted into the master boot record (MBR) of the victim's computer, and the system restarts. On ...
12
votes
1answer
2k views

Will resize of an image execute the file?

Our server was exploited by a ransomware. We allow admins to upload PDF, docx, excel etc. But also images and SVG. And we use dragonfly to generate thumbnails on those files that are supported. Let'...
125
votes
4answers
13k views

How does ransomware get on people's computers?

I've noticed increased frequency of ransomware questions around Stack Exchange. Some of the people I remotely know had their devices recently infected as well. I'm starting to be concerned. When ...
45
votes
4answers
8k views

Can the ransomware encryption key be derived from comparing encrypted and unencrypted files?

A firm has 10 million files, all ransomware encrypted, but the firm has all of those 10 million files backed up, and almost all of them have not changed. Would comparing all of those files against ...
21
votes
3answers
3k views

Would it be plausible to write your own anti-crypto-ransomware tool? [closed]

Question After reading about how basic ransomware targets and encrypts your files. I was wondering if it would be plausible to write your own script to try and detect such activities? Initial ...
7
votes
1answer
1k views

How does this javascript attack work?

There is a closed question on StackOverflow with a similar code excerpt but it is closed due to not being a programming related question so I thought I would ask here instead. It was emailed in a Zip ...
3
votes
1answer
245 views

Has my server been compromised? (Ransomware related)

I just received an email that corresponds to the description here, which was posted just a couple of hours ago: https://myonlinesecurity.co.uk/pdfpart2-pdf-sent-from-my-samsung-galaxy-note-4-powered-...
6
votes
1answer
338 views

How to spare file server data from being held hostage by client ransomware?

Suppose in a network there is a file server which's storage is shared between all workstations and all users require full read/write access to this storage for their cooperation workflow. (Over samba, ...
4
votes
1answer
333 views

What are the actions of Locky on the source files which lead to encrypting?

During discussions about possible actions to mitigate the risk of the ransomware Locky, someone pointed at the possibility of preventing at OS level the creation of .locky files via the File Server ...
5
votes
1answer
3k views

Ransomware in virtual machines. Running Locky for testing security measures

We have several binaries of the ransomware Locky. We tried to run it in a virtual machine, which has several storages like Samba, etc. attached, in order to see how the files are going to be encrypted....
0
votes
1answer
224 views

Is that possible for Linux and windows machines to be infected with KeRanger ransomware?

According to theguardian The Transmission site offers the open source software that was infected with the ransomware called KeRanger malware, it's programmed to encrypt files on an infected personal ...
3
votes
3answers
636 views

How can I protect myself from “ransomware” attacks like the one that affected Transmission users?

The downloader for version 2.90 of the Transmission BitTorrent client was infected by a piece of malware called KeRanger, which encrypts files on your computer and demands a one-Bitcoin ransom to ...
-2
votes
1answer
175 views

Teslacrypt Ransomware [duplicate]

I would like to know how to decipher a Windows 7 system that has been infected with a variant of Teslacrypt that: Encrypts a bunch of files and adds up "mp3" extension to theim Creates new files in ...
1
vote
1answer
203 views

Are the 'silent' cryptolockers around?

A few days ago I noticed a discussion on a website about cryptolockers. Someone said a cryptolocker operates silently untill it has encrypted all files and then comes visible to the user. The ...
3
votes
2answers
1k views

Encryption: Files that can't be encrypted/cryptolocker family doesn't encrypt?

Are there any type of file whatsoever that can -not- be encrypted? Is there any data that can't be encrypted by the regular RSA encryption methods? Also, does anyone know what files the cryptolocker ...
4
votes
3answers
2k views

How does “Ransomware” Work?

So I am wondering how Ransomware files work. I know Ransomware encrypts all files with AES-256 for speed but where does RSA come in? Apparently RSA is slow to encrypt files so it uses AES-256 first ...
80
votes
6answers
13k views

Getting files back by paying Ransomware

A company I support/do work for has been hit with ransomware. I've gone down all the data recovery paths etc ... and the business has decided that paying the ransom is cheaper then rebuilding and ...
8
votes
1answer
1k views

Is Apple's AirPort Time Capsule vulnerable to ransomware?

I have a Macbook Air laptop and use Apple's Time Machine program and an AirPort Time Capsule (physically connected to my router via ethernet cable) to periodically back up my data. If my laptop were ...
3
votes
1answer
293 views

Android ransomware difficulties [closed]

My phone is a Samsung Galaxy S2. I have somehow gotten some ransomware that is displaying device information, including my name and recent contacts' data. The ransomware starts basically right away, ...
4
votes
3answers
3k views

Does DNS-based blocking protect against ransomware?

I have been looking into OpenDNS as something to possibly use at my company, and they claim that Cryptolocker-style ransomware almost always uses DNS to "phone home" and that OpenDNS blocks this, ...
3
votes
1answer
1k views

How does Cryptolocker propagate?

One of the computers in my office has been compromised by Cryptolocker. Once informed, my immediate response was to disconnect the computer from the network - though there was a period of a few hours ...