WannaCryFake勒索病毒家族详情
本帖最后由 Potato 于 2020-4-10 17:32 编辑勒索病毒家族名称：WannaCryFake勒索病毒
是否支持解密：否
详情：
被加密文件：
被加密文件后缀格式： [recoverydata54@protonmail.com].Wannacay
勒索提示信息：
文件名：
文件内容 ：
-------------------------------------------------------------------------------
All your files have been encrypted!
All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail recoverydata54@protonmail.com
also You can use telegram ID:@data54
You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the tool that will decrypt all your files.
Free decryption as guarantee
Before paying you can send us up to 5 files for free decryption. The total size of files must be less than 4Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.)
How to obtain Bitcoins
The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.
https://localbitcoins.com/buy_bitcoins
Also you can find other places to buy Bitcoins and beginners guide here:
http://www.coindesk.com/information/how-can-i-buy-bitcoins/
Jabber client installation instructions:
• Download the jabber (Pidgin) client from https://pidgin.im/download/windows/
• After installation, the Pidgin client will prompt you to create a new account.
• Click Add
• In the Protocol field, select XMPP
• In Username - come up with any name
• In the field domain - enter any jabber-server, there are a lot of them, for example - exploit.im
• Create a password
• At the bottom, put a tick Create account
• Click add
• If you selected domain - exploit.im, then a new window should appear in which you will need to re-enter your data:
o User
o password
o You will need to follow the link to the captcha (there you will see the characters that you need to enter in the field below)
• If you don't understand our Pidgin client installation instructions, you can find many installation tutorials on youtube - https://www.youtube.com/results? ... dgin+jabber+install
Attention!
• Do not rename encrypted files.
• Do not try to decrypt your data using third party software, it may cause permanent data loss.
• Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.
-------------------------------------------------------------------------------
弹窗：
防护建议：
1.多台机器，不要使用相同的账号和口令
2.登录口令要有足够的长度和复杂性，并定期更换登录口令
3.重要资料的共享文件夹应设置访问权限控制，并进行定期备份
4.定期检测系统和软件中的安全漏洞，及时打上补丁。
5.定期到服务器检查是否存在异常。查看范围包括：
a)是否有新增账户
b) Guest是否被启用
c) Windows系统日志是否存在异常
d)杀毒软件是否存在异常拦截情况
6.安装安全防护软件，并确保其正常运行。
7.从正规渠道下载安装软件。
8.对不熟悉的软件，如果已经被杀毒软件拦截查杀，不要添加信任继续运行。
现在360安全卫士有检测木马功能，但是好像没有针对已经被勒索病毒加密的文件进行检测功能；前段时间我们公司局域网遭遇勒索病毒，期间我360和火绒都是是一直打开的，但是我的文件还是被加密了，360没有任何反应，而且我见手动检测的时候也没有提示有文件被加密；所以这个功能目前看起来好像360还是不具备的。
页:
[1]