Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 4 replies
  • Subscribers 3 subscribers
  • Views 8439 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

might be a variety of TeslaCrypt, ransomeware

yurikokuroki

Hello,

I am Yuriko, I would like to ask a virus / malware issue that has not detected with Sophos Endpoint Software.

There is a pc that might be infected with a new variety of TeslaCrypt, ransomeware and all files were encrypted with filename.xxx, Trend virus baster installed on that pc but not detected anything.

I tired to download Sophos Endpoint Software and installed it onto the affected pc, scanned all but nothing detected.

According to the information of this ransomeware, it will be vanished away of itsefl after the virus behavior was taken.

I am not a corporate user of Sophos but a trial user. In this case, I am wondering whether or not Sophos could investigate to release new identities if I provide some files to your lab. 

If this is not appropriate community, please let me know where i find it. 
Thank you,

Yuriko



This thread was automatically locked due to age.
Parents
  • 0

    Hello Yuriko,

    might be infected
    what is - might? The purpose of this type of ransomware is to make money from the "decryption service" and therefore it clearly states that it has done its dirty deed. It's not really an infection, rather a one-off act an as you say it takes care in removing itself afterwards (and therefore the tools do not detected anything).
    if I provide some files - you might or might not find traces of the "early stages" of the attack (in the usual %temp%, download, or cache locations and a creation timestamp from around the start of the encryption) and you can submit suspicious files here. There's no use though in sending one or more of the encrypted files.

    Christian

Reply
  • 0

    Hello Yuriko,

    might be infected
    what is - might? The purpose of this type of ransomware is to make money from the "decryption service" and therefore it clearly states that it has done its dirty deed. It's not really an infection, rather a one-off act an as you say it takes care in removing itself afterwards (and therefore the tools do not detected anything).
    if I provide some files - you might or might not find traces of the "early stages" of the attack (in the usual %temp%, download, or cache locations and a creation timestamp from around the start of the encryption) and you can submit suspicious files here. There's no use though in sending one or more of the encrypted files.

    Christian

Children
No Data
Unfiltered HTML