Questions tagged [ransomware]

Ransomware is a lethal kind of Malware that Encrypts your harddrive(s) and holds them hostage, providing the decryption key if you pay the hostage-taker(s) money (well-known variants are the FBI Virus and the Police Virus).

Filter by
Sorted by
Tagged with
1
vote
1answer
454 views

Information on cryptolocker seeking ransom via email to certain email address

A friend of mine was recently attacked by this new cryptolocker in an unusual way. I anticipate my question: what kind of cryptolocker is this, what could the attack vector be, and is a cure available ...
1
vote
1answer
256 views

Can ransomware run without prompting user? [duplicate]

That is, a user downloads attachment from email and runs it, will the ransomware run silently without showing the security prompt/UAC (that should block non-administrator users...)
1
vote
1answer
413 views

A few files on a domain controller were encrypted - how could that have happened?

I've just realized that the policies on one of our Windows domain have been failing. I've traced the problem and it turned out the INI files were encrypted by Globe ransomware (or one of its variants)...
1
vote
1answer
816 views

Decrypt a file by knowing the original content [duplicate]

We had some ransomware get into our system a couple of weeks ago, and it has encrypted a large amount of our files. I am wondering, is it possible to figure out an encryption key if I know the ...
1
vote
2answers
279 views

Is this a virus or what? DECRYPT_INFORMATION

On my computer there are lots of html files with titles DECRYPT_INFORMATION. I have scanned them with AVG and it says they are no threat but I am suspicious. I don't know html so when I open them on ...
1
vote
2answers
1k views

How did Wanna Cry get past Antivirus Programs

For those who had windows computers when the WannaCry virus hit, how exactly did the virus bypass antivirus programs. I have tried to read some papers about this, but I don't understand how exactly ...
1
vote
1answer
105 views

Backup to non-persistent mapped NAS

My backup mechanism until now is a batch file to copy my data folder to my NAS, which is permanently mapped as Drive N:. I have a batch file (BackShut.bat) which mirrors my data directory to the NAS ...
1
vote
1answer
165 views

Security of a backup server

I am concerned about attacks of the crypto malware which encrypts all storage reachable (for a ransom payment you get the key to decrypt). I use only Linux (Debian) and have a separate ARM computer to ...
1
vote
2answers
372 views

Unencrypt Data Encrypted by Cryptolocker Virus [duplicate]

A while back my computer was encrypted by the cryptolocker virus. I ended up taking an image of the encrypted drive and then formatting it and installing a new operating system. Since I have the ...
1
vote
2answers
517 views

May I install more than one anti ransomware on the same pc?

I installed Bitdefender anti ransomware free tool, but as I read: It is only good against CryptoWall and CTB-Locker. So I'd like to install some others, but I wonder: Is it recommendable to ...
1
vote
2answers
283 views

Would a RansomWhere application be possible for Windows too?

This is related to RansomWhere? which is a OS X specific defense developed by a former NSA employee. The premise is that it will "generically" stop ransomware from encrypting files on the OS. ...
1
vote
1answer
204 views

Are the 'silent' cryptolockers around?

A few days ago I noticed a discussion on a website about cryptolockers. Someone said a cryptolocker operates silently untill it has encrypted all files and then comes visible to the user. The ...
1
vote
2answers
229 views

Limitations of botnets [closed]

My question is very closely related to this question but I didn't find my answer there. Specifically, I'm interested in whether the C2 server can modify aspects/properties of the malware and, if so, ...
1
vote
1answer
96 views

Can Android 5's own device encryption mechanism be exploited by a malware?

My wife's phone can't boot into android and instead displays a message that encryption has failed and all data is lost. She did not start the encryption process by herself. Now my question is: can ...
1
vote
0answers
152 views

How to prevent the ransomware to run with administrator privileges?

We have been attacked by the ransomware recently (adobe li). The strange thing is that ransomware was able to gain unimaginable high privileges. The virus of the ransomware has been located on the ...
1
vote
0answers
827 views

NotPetya Information and Updates [closed]

I was wondering if there were any people here who had any useful links or information on the new NotPetya attacks. Is there any good websites to monitor attacks like this or if there are any good ...
1
vote
2answers
115 views

What happens if your email file on local drive get's encrypted and it then syncs to the cloud? [closed]

Does email syncing using MS Exchange exchange work in a similar way to Dropbox such that a change made on the local drive automatically syncs with the cloud version of that file? Or is it one way only ...
1
vote
0answers
114 views

Is there a public malware sample of WannaCry? [duplicate]

Google security researcher Neel Mehta has famously identified code similarities between a sample of WannaCry and code used by North Korean hacker group Lazarus in 2015. Around the same time, another ...
1
vote
0answers
127 views

WannaCry ransomware backtrace [closed]

Can law-enforcement agency trace the source of code, emails or bitcoins destination to catch criminals? After all, someone will get these bitcoins and someone will be using a computer to do it?
1
vote
1answer
711 views

How to detect Ransomware [closed]

I have installed a SIEM on my company that is based on Alienvault USM correlation rules. How can I detect Ransomware activity on my network? I already enabled Suricata IDS on all of my network ...
1
vote
0answers
146 views

How can I decrypt a ransomware encrypted imme files [closed]

I have tried multiple online available ransom decryption but they don't seem to be working, can you please guide which tool can assist me? I have attached the encrypted files snapshot with this post. ...
1
vote
0answers
54 views

How can I find out which process was stopped by RansomWhere? [closed]

Edit: Since this question turned out to be off-topic here, I've re-posted it to Ask Different. I use RansomWhere, a tool to protect from ransomware. As far as I understand, RansomWhere just warns ...
0
votes
4answers
4k views

Can I decrypt files encrypted by Odin ransomware?

My system, excel, rar and zip files are encrypted by Odin ransomware and my ethics never allow me to pay ransom to thieves. I tried recovery softwares but only recovered old deleted files - no ...
0
votes
1answer
314 views

Affected by Marlboro Ransomware (“.oops” extension) - Which decryptor to use to decrypt the files?

My friend got infected by "Marlboro" Ransomware (description of the nasty thing: http://sensorstechforum.com/marlboro-ransomware-remove-restore-oops-files/). I have researched online, and a way to ...
0
votes
2answers
2k views

Ransomware doesn't change file extension after encryption

Today, one of my end users using Windows 7 (for reference) got infected with a ransomware variant that weirdly enough doesn't seem to have changed the files's extensions. Is this possible? Is there a ...
0
votes
1answer
280 views

Company name is used in Dropbox invoice scam

People, not employees or users, just ordinary people with no relation to us, have been getting scam emails, prompting them to open and download a link from Dropbox. I think this link contains files ...
0
votes
2answers
569 views

How can I get notified about the publishing of ransomware decryption keys

My computer had been hijacked by "Cryptolocker" a ransomware you might be well aware of. The nasty ransomware has encrypted most of my documents and video files. I used an anti-malware and removed the ...
0
votes
1answer
283 views

Ransomware encrypted first 64 kB of file

I heard about a ransomware virus going around that encrypts only the first 64 kB of a file. If I was infected with this, would it be realistically possible to retrieve my files?
0
votes
1answer
139 views

Is it possible to provide malware from a router?

I received a disturbing mail containing the password for my desktop computer account. In this mail the hacker stated that he used a vulnerability in my router with CVE: CVE-2020-1672. After searching ...
0
votes
1answer
152 views

Why doesn't WannaCry ask to “make changes to this computer” when you run the exe? [duplicate]

When you click on WannaCry, why doesn't it ask "do you want the following program to make changes to your computer?" I've watched videos of people running wannaCry, and it doesn't. I've also watched ...
0
votes
1answer
68 views

Finding/Predicting BotNet Generated Domains Without DGA Knowledge

I will pose an academic perspective in my question, but I welcome any and every observation. So a botnet would generate 1000s of domain/day and an actual attacker will register a few, which will be ...
0
votes
2answers
113 views

limiting automated domain creation by malware

As we know most of the malwares create thousands of domains and subdomains using DBA for setting C&C communications. The domain names are controlled by Internet Corporation for Assigned Names and ...
0
votes
2answers
75 views

Is there external service which can detect ransomware?

I am thinking about ways of protecting against ransomware other than backing up all data. So i thought is there such service which could scan trough emails and find does email contains links or other ...
0
votes
1answer
115 views

Do backups with application-level authentication defeat ransomware?

While having "too much time" and after some careful thinking from my side, I kinda "found" that if you authenticate at application level, ransomware would have to carefully analyze all known settings ...
0
votes
1answer
60 views

Are my personal files safe from BORA ramsomware if I have set them to 'read only'?

A friend's PC got infected with BORA ransomware 2 days ago and I was wandering if his files would have been encrypted if he had made them 'read only' before the ransomware had struck. Is it possible ...
0
votes
1answer
200 views

Will re-imaging kill ransomware?

Pretty much what the title suggests. I understand its quite vague so apologies. I'm just not sure if it's able to install something that will sit elsewhere on the machine (as in not on the C:) which ...
0
votes
2answers
168 views

How files of ransom attacks were decypted?

In this site is was announced that everybody can decrypt the files victim of a ransom attack. They just don't tell you how it was possible. It's supposed the files were encrypted with an encryption ...
0
votes
1answer
307 views

Why does a perfc file cure/kill Petya ransomware (is it a bug or a deliberate decision of the creators)?

Why does a perfc file in the Windows directory prevent the recent Petya ransomware? Is it a bug in the ransomware that halt's it from executing? Or is it a deliberate attempt of the creators to allow ...
0
votes
3answers
173 views

How to keep client data confidential when attacked by a ransomware?

Hypothetical scenario: If a ransom-ware attack was to happen which threatened to make public "private client data" if you didn't pay up. Assuming such a virus exists and you've already been infected,...
0
votes
1answer
84 views

How to remove STOP Ransomware

Guys hello. One of my friend laptop get infected with STOP ransomware, all files are encrypted with .mosk extension.The admin account of machine is also compromised, we tried to install emisoft ...
0
votes
1answer
104 views

Ransom-ware nuclear. how did it get into my pc? [closed]

Got infected, it happened as i was sitting on the PC (Windows 10), i noticed a slow-down and one of the external disks had high activity, upon inspection noticed some files had the .nuclear extension. ...
0
votes
1answer
265 views

SVG virus/ malware with an extension on Google Chrome (one) [closed]

This question is about the SVG virus malware I got through Facebook, which adds a malicious Google Chrome extension. It's called one or ubo. Some articles write that it is ransomware. I think I ...
0
votes
1answer
310 views

Ransomware note found - cannot find encrypted files

I have a note on my machine which indicates that my machine has ransomware on it. I've done a system restore of my machine back several weeks, and each time the files keep coming back. My files are ...
0
votes
1answer
143 views

Possible Ransomware Infection, want to clarify some things [duplicate]

I am not sure whether ransomware attacked a pc in my home setup. An adware popup came up and locked the browser however i ended the process and ran my av, nothing was detected. There were usb drives ...
0
votes
1answer
599 views

How to decrypt file that was attacked by ransomware? [closed]

there are a ransomware attacking on of my computer and most of the file has been renamed to something like id-2832SGndfDcbv.supportfriend@india.com.xtbl The file isn't corrupted as the file still ...
0
votes
1answer
126 views

What kind of damage does the HummingBad Android malware do when it fails to gain root access?

There is this Android virus out there called HummingBad, and it seems the first thing it tries to do is try to get root access. There are so many device models out there, and the rooting process is ...
0
votes
1answer
224 views

Is that possible for Linux and windows machines to be infected with KeRanger ransomware?

According to theguardian The Transmission site offers the open source software that was infected with the ransomware called KeRanger malware, it's programmed to encrypt files on an infected personal ...
0
votes
2answers
449 views

Will Ad Block Plus block the ads that give someone Cryptowall 2.0?

Now I already know that making sure your browser plugins are either non-existent or up-to-date is one way of being on the safe side against ransomeware like Cryptowall 2.0; but since clicking ads are ...
0
votes
1answer
91 views

micro segmentation in the campus [closed]

We have so many devices (IoT and wintel, macs, androids, ios) spread across a few VLANs. Worried about any one device getting affected (e.g. Ransomware) and potentially infecting all other devices on ...
0
votes
1answer
200 views

Ransomware on Mycloud NAS

I own a Mycloud NAS and it was affected by ransomware. In the NAS there are several folders, most of them are password protected. There is also the "Public" folder which can be seen by all users and ...