The Latest in IT Security

WannaCry mistakes that can help you restore files after infection

02
Jun
2017
WannaCry mistakes that can help you restore files after infection

ransomware-e1478708762258

Sometimes ransomware developers make mistakes in their code. These mistakes could help victims regain access to their original files after a ransomware infection. This article is a short description of several errors, which were made by the WannaCry ransomware developers.

Errors in file removal logic

When Wannacry encrypts its victim’s files, it reads from the original file, encrypts the content and saves it into the file with extension “.WNCRYT”. After encryption it moves “.WNCRYT” into “.WNCRY” and deletes the original file. This deletion logic may vary depending on the location and properties of the victim’s files.

Read More

Leave a reply


Categories

WEDNESDAY, AUGUST 16, 2017

Featured

Archives

Latest Comments

Social Networks