Questions tagged [ransomware]

Ransomware is a lethal kind of Malware that Encrypts your harddrive(s) and holds them hostage, providing the decryption key if you pay the hostage-taker(s) money (well-known variants are the FBI Virus and the Police Virus).

Filter by
Sorted by
Tagged with
2
votes
2answers
721 views

Can a ransomware “destroy” git remote repositories?

Instead of a backup, i store my important documents (my resumee, certificates and such) in a git repository - which is then pushed to sth like github. My reasons for using git instead of an backup ...
2
votes
2answers
204 views

Why cant i run malware in my Virtual Environment

Im trying to run some malware samples in my Virtual lab to capture their IOC's. Im doing this for my Masters Thesis but i can not seem to get the malware to run. I have downloaded samples from hybrid ...
2
votes
4answers
184 views

Why is phishing becoming synonymous with ransomware?

The Wikipedia definition of phishing is: the fraudulent practice of sending emails purporting to be from reputable companies in order to induce individuals to reveal personal information, such as ...
2
votes
2answers
3k views

Does Wanna Cry encrypt files on network drives?

I've dealt with ransomware threats in the past, such as LOCKY that not only encrypt data it considers user documents found on the local machine, but also on any network drive to which the user has ...
2
votes
2answers
1k views

Can ransomware affect hidden or “unmounted” drives?

I have an understanding of how ransomware works to a certain extent. But, I would like some input as to what it can do if the volumes/drives that are on a workstation are not visible or are not ...
2
votes
2answers
454 views

Protect backup from ransomware [duplicate]

I'm planning to (finally) backup all my personal files from my home network on a new HDD. If I'd use an external HDD with USB cable the ransomware would theoretically encript these data too. Would ...
2
votes
3answers
647 views

Is there now an increased risk of ransomware in pirated software?

Ransomware is on the rise, much due to new ransom-paying opportunities via Bitcoin. Has there been a reported increased risk of ransomware in pirated software (i.e. so called “warez”) – outside of ...
2
votes
2answers
300 views

Is this Backup Safe from Ransomware?

I'm planning a home backup setup, and I'm not sure if I really understand this quite right. The idea is I'll set up a Linux server on the network that contains two drives. Drive1 will be network-...
2
votes
1answer
509 views

Does CryptoWall needs a internet connection to encrypt my files?

Does CryptoWall 3.0 use some resource on the internet to encrypt my files? I watched this video on YouTube - in this video a tool is used to sniff network traffic and find information about ...
2
votes
1answer
242 views

Dropbox ransomware experience

How Dropbox handles ransomware issues? Can it effectively restore files encrypted by ransomware? The reason I am asking is because I am looking for a bullet-proof solution against ransomware and ...
2
votes
1answer
232 views

How does Ransomware use vssadmin.exe with admin privileges

I am doing some research about Ransomware and their methods. In many articles they write that the ransomware performs vssadmin.exe to delete shadow copys. And I found following Information about how ...
2
votes
2answers
666 views

Can the new WannaCry affect Linux ext4 file system data from Windows?

So every now and then I switch over to my Windows 10 OS from my Linux partition. Whilst I am there, I am fully aware that I can be infected with WannaCry which will encrypt all the files on the system....
2
votes
2answers
814 views

Who put the killswitch in the WannaCry ransomware? [closed]

The WannaCry ransomware contains a killswitch, a URL that when registered, caused the malware to shutdown. Question is, who put in the killswitch? Was it the bad guys? Was it the NSA? Could it have ...
2
votes
2answers
162 views

Is ransomware that threatens with publication and verifiably deletes upon payment possible?

Inspired by the article The future of Ransomware and its description of possible ransomware with verifiable key delivery, I wonder if the idea can be taken further into ransomware that credibly ...
2
votes
1answer
1k views

How dangerous is SMBv1?

I have a NAS (network disk) from Zylex which stopped working under Windows 10 a while ago. Investigation shows that it uses SMBv1, which was implicated in several ransomware attacks and was therefore ...
2
votes
1answer
159 views

Is it possible to “steal” someone else's ransomware bitcoin payment? [closed]

I'm not too sure if this belongs on security.SE, so feel free to close or migrate to a different SE. It seems that many ransomwares use Bitcoin as currency (for good reason), and tell you to send X ...
2
votes
4answers
211 views

Archival storage for ransomware defense

Thinking about the threat posed by ransomware, the defense that makes the most sense to me is to have a secure copy, and an automated way to restore protected files. Ordinary backups are not really ...
2
votes
1answer
1k views

How does ransomware connect to the Tor deep web?

A lot of ransomware and malware uses deep web services to get their key. I was wondering if they carry the Tor browser with them or if they use some other technique, as I don't think everyone has Tor ...
2
votes
1answer
140 views

How to respond to ransom attack

While the last ransom attack -WannaCry- Shook the world some forensic and malware analysis provided some help to stop the disaster or to slow it down. While reading Matt Suiche blog, he mentioned that ...
2
votes
1answer
2k views

WannaCry - block callback IP/domain?

While new variants of Wannacry has sprung up, the old variant is still lurking around corners and I am not sure whether the following callback IPs and domains should be blocked as per typical ...
2
votes
1answer
308 views

Can I hook “vssadmin.exe delete” process?

I'm studying and listing ransomware family.(like CryptoWall, TorrentLocker, CTB-Locker, .etc) When I read the features of those family, they do vssadmin.exe to delete shadow copies of victim's PC so ...
2
votes
1answer
988 views

How does the MFT encryption work?

A few week ago there was a ransomware called Petya delivered via Dropbox links. The new ransomware is inserted into the master boot record (MBR) of the victim's computer, and the system restarts. On ...
2
votes
1answer
298 views

prevent Ransomware on CIFS shares mounted on Windows 10

I am using Windows 10 with Defender. I follow all the ground rules when dealing with the internet and staying secure. I work in IS so I'm pretty familiar with the various threat-vectors and do a good ...
2
votes
1answer
138 views

Is this ransomware encryption or file corruption?

I have backups of a user folder from an older drive that I am getting to organizing now and noticed files are either corrupted or encrypted. File extensions and names are not changed, appears exe ...
2
votes
1answer
913 views

How does erebus infect Linux systems?

Today I read about ransomware called Erebus that supposedly targets Linux servers and encrypts all the data there. What I can't find is any reference to the details of this type of attack, i.e. how ...
2
votes
1answer
305 views

How does WannaCrypt detect when someone pays the ransom?

It seems they are processing it manually, but how can they verify the payment? WannaCry doesn't provide a unique ransom bitcoin adress for each victim.
2
votes
2answers
465 views

Rename important files to any file type to protect from ransomware

Is it a good solution that rename an important files to a new file type that only owner od the file know? like Data.Rar rename it to Data.BEATURAN, so it will become BEATURAN File and just rename ...
2
votes
1answer
138 views

Write protect a partition

I have an HDD partition that contains a Karaoke song library of 400 GB. Backing it up is cumbersome at best and requires a large external drive and hours of time. The library is the only thing on the ...
2
votes
1answer
206 views

Ransomware - All computers infected but one

Let's say there is a particular network which has a "monthly" successful cryptolocker attack. Every time, every computer in that network is infected. The set up is like this: 1x Windows 2003 server (...
2
votes
0answers
2k views

Ransomware with .adobe extension

It is possible to decrypt file with .adobe extension ? File after encryption look like this : filename.id-5735353.[email@example.com].adobe . I did a little research and found information about "....
2
votes
0answers
212 views

How to implement a Crysis ransomware master key?

I see there have been master keys released to decrypt computers affected by the Crysis ransomware. If a computer is infected with Crysis, how would one actually test/run the key on the computer? ...
2
votes
0answers
36 views

Ransomware Type of Virus and How to prevent it (Zepto Virus) [duplicate]

My computer had been hit by a Zepto virus which is a type of ransomware. All my files had been encrypted to a file that cannot be opened by any applications. It only hits all my office document files. ...
1
vote
3answers
945 views

What do emails have to do with the spread of WannaCrypt?

After the recent spread of WannaCrypt, there has been a lot of warnings about the dangers of emails and clicking on links in them. But the malware is spreading as a worm using SMB to infect other ...
1
vote
4answers
287 views

How can I defend my mail server against ransomware?

First of all I'm aware that I should use some anti-virus mechanism to prevent as much as possible any ransomware being delivered through my mail server - and yes I'm already using that kind of ...
1
vote
4answers
182 views
+50

Ransomware aversion and identification techniques

I don't think there's a need to go into the background here, but identification of the process may be better explored. From a developer pov, at a high level, the files are modified, by virtue of the ...
1
vote
1answer
477 views

How can we beef the security of our Windows Server 2012 R2 against ransomware? [duplicate]

We have a MS Windows Server 2012 installed. After the attacks of last week, I was wondering how we could improve the security of the server against ransomware/cryptoware. We did install the latest ...
1
vote
4answers
509 views

A ransomware locked my operative system on C. Are the other drives at risk?

I think I have a ransomware avoiding me to access Windows, for each time I restart my PC Windows boots but no login window appears and I cannot perform any operation but selecting the power and the ...
1
vote
2answers
109 views

Is VPN a likely access point through which to deploy a ransomware payload?

We run a small office network with Windows SBS 2011 and Draytek Vigor 3300 router. We recently had a ransomware attack in which it currently appears the payload was run on the SBS server itself. ...
1
vote
2answers
1k views

Why does WannaCry encrypt symmetric key with a new per-victim-only public key?

According to this answer, WannaCry will: Generate AES key at victim's system to encrypt victim's files. Generate RSA key at victim's system to encrypt AES key generated above. Encrypt private key of ...
1
vote
3answers
138 views

Why aren't hardware R/W switches used to defend hard drives?

ISTR back in the early days of (build your own) PCs having an old 486 PC with two hard drives, and hacking the "Turbo" switch on the front panel (remember those?) to be a read-protect switch for ...
1
vote
1answer
249 views

Has anyone actually been hacked by video subtitles?

This morning's news brought this story: Hackers are hiding computer viruses in film subtitles, security experts warn Where they warn that subtitles in videos played on computers could be used to ...
1
vote
2answers
4k views

Protection from ransomware using virtual machine

I have been recently reading about rise in ransomware attacks such as CryptXXX and I was curious about I can protect myself from such attacks. I have a Windows 10 x64 system. Some measures I took are ...
1
vote
2answers
496 views

The best way to prevent ransomware and virus? [closed]

I am using Avast free antivirus real time protection and weekly scan Malwarebytes free anti malware weekly scan Malwarebytes Anti-ransomware EMET good enough? Anything else I should do or choose ...
1
vote
1answer
556 views

Crypto Ransomware - How decryption is done when user accept to cooperate?

When you have been "hacked" and you accept to pay for decrypting your encrypted files, how the attacker do the job ? I understood that a symmetric key is used, itself encrypted by the attacker public ...
1
vote
1answer
254 views

I found an RSA private key on my ransomware-infected device. Can I use it to decrypt the files?

I have ransomware on my laptop. I ran Spyhunter and deleted as much as I could. I found an RSA in the Windows registry with regedit. Then, as I was checking for unknown files, I found a .android file ...
1
vote
1answer
380 views

Why do some ransomware executables run on VirtualBox? [closed]

Even though they appears to have anti-VM capabilities? I've downloaded some latest samples of ransomware executables from cerber, locky, and other family of ransomware Why do they still execute in ...
1
vote
2answers
428 views

Is it possible to recover wannacry encrypted files through file system recovery?

As I saw wannacry encrypts files and then removes them, I thought it is possible to recover some of the original files by file system recovery using a bootable OS. Is it possible to use a bootable ...
1
vote
1answer
175 views

Was the 2017 NHS attack targeted?

The news has been alive with the HNS ransomware story this weekend (13th May 2017) and the coverage has been loose guesswork at best generally. So what I'm trying to figure out is: Was this actually ...
1
vote
2answers
126 views

Can an application modify files that are in a password protected folder?

Specifically regarding Win 10 and this method of password protecting a directory. Would a malicious application be able to modify files placed in this directory or would it be stopped? Thanks for ...
1
vote
1answer
2k views

Dharma ransomeware files decryption [closed]

One of my clients send me some picture that shows they infected by some ransomware. As i analysed i found that ransomware is probably Dharma ransomware, child of Crysis. so i tried to decrypt files ...