Book Image

Preventing Ransomware

By : Abhijit Mohanta, Mounir Hahad, Kumaraguru Velmurugan
Book Image

Preventing Ransomware

By: Abhijit Mohanta, Mounir Hahad, Kumaraguru Velmurugan

Overview of this book

<p><span id="description" class="sugar_field">Ransomware has turned out to be the most aggressive malware and has affected numerous organizations in the recent past. The current need is to have a defensive mechanism in place for workstations and servers under one organization.</span></p> <p><span class="sugar_field"><span id="description" class="sugar_field">This book starts by explaining the basics of malware, specifically ransomware. The book provides some quick tips on malware analysis and how you can identify different kinds of malware. We will also take a look at different types of ransomware, and how it reaches your system, spreads in your organization, and hijacks your computer. We will then move on to how the ransom is paid and the negative effects of doing so. You will learn how to respond quickly to ransomware attacks and how to protect yourself. The book gives a brief overview of the internals of security software and Windows features that can be helpful in ransomware prevention for administrators. You will also look at practical use cases in each stage of the ransomware phenomenon. The book talks in detail about the latest ransomware attacks involving WannaCry, Petya, and BadRabbit.</span></span></p> <p><span id="description" class="sugar_field">By the end of this book, you will have end-to-end knowledge of the trending malware in the tech industry at present.</span></p>
Table of Contents (16 chapters)
Title Page
Packt Upsell
Contributors
Preface
Index

2. ScreenLocker ransomware


 This ransomware does not encrypt files on the victim's machine. It locks the entire screen and does not permit the victim to do anything else till he pays the ransom. ScreenLocker is normally downloaded from exploit kits, mostly in the recent past.

The following is a list of some of the popular ScreenLocker ransomware:

  • Reveton
  • Urausy
  • Kovter
  • Tobfy
  • Weelsof
  • BlueScreen
  • Koktrom
  • Winlock
  • LockScreen

Details about some of these families will be covered in later chapters.

2.1 How does ScreenLocker ransomware work on Windows OS?

The following points give a brief idea of how the ransomware achieves the screen locking functionality. Some keywords are used that are related to programming:

  • A ransomware can use the EnumWindows() API to find out all windows (GUIs of other processes) after which it puts all the windows in the background. Finally, the ransomware window remains at the top of other windows.
  • Ransomware window covers the full screen.
  • The victim should not be able to resize the window...