Link to home
Start Free TrialLog in
Avatar of James Jin
James JinFlag for United States of America

asked on

Paradise ransomeware with .STUB

Is there any file decryption tools for paradise ransomeware infested files with .STUB extension?
Avatar of ☠ MASQ ☠
☠ MASQ ☠

Not currently :(

Also like a number of ransomware packages the Paradise variants drop a random unique encryption key (which itself is encrypted) on each affected machine so even the criminals using Paradise don't know the key until you supply it.

You could back up the drive in the hope that a decryption method becomes available.  Otherwise it's just about restoring from backups.

You can upload some small affected files to identify and confirm the encryption used here:
https://www.nomoreransom.org/crypto-sheriff.php?lang=en
Try the same overall approach as in this thread:
https://www.experts-exchange.com/questions/29142122/IGAMI-virus.html

Quote from there:

Implement a good, offline and frequently offsite backup.

Restore your files from your current backup.

Implement a solid spam filter (that is how ransomware comes in).

Train users not to open emails from strangers and not to go to dodgy websites.
Prevention better than cure

Get rid of over privileged users, such as ones in DA
https://www.experts-exchange.com/articles/29596/Securing-Active-Directory-Administrators-Groups.html

Implement a delegation model
https://www.experts-exchange.com/articles/29366/Delegation-the-proper-way.html

Securely manage local admin passwords, and administrator members
https://www.experts-exchange.com/articles/31583/Active-Directory-Securely-Set-Local-Account-Passwords.html
https://www.experts-exchange.com/articles/30617/How-to-manage-local-account-passwords-from-Active-Directory-without-LAPS.html
https://www.experts-exchange.com/articles/29652/Strategy-to-centrally-manage-Local-Administrators-group-from-Active-Directory.html

Get rid of old accounts that might be used maliciously
https://www.experts-exchange.com/articles/30820/Active-Directory-Cleanup-Tool-ADCleanup.html

Implement tier-isolation to prevent tier jumps from lateral movement
https://www.experts-exchange.com/articles/29515/Active-Directory-Simple-Tier-Isolation.html

Create intelligence password policies
https://www.experts-exchange.com/articles/33078/How-to-create-an-Intelligent-Password-Policy-for-Active-Directory.html

Utilize host-based firewalls, Windows or otherwise
https://www.experts-exchange.com/articles/31687/Windows-Firewall-as-Code.html

Do AD password audits
https://www.experts-exchange.com/articles/29515/Active-Directory-Simple-Tier-Isolation.html

Create your file server structure using the least privilege principle
https://www.experts-exchange.com/articles/32349/FSMainFolder-Files-Server-Structure-Automation-Tool.html

Implement Security Hardening Policies
https://www.cisecurity.org/
Ransomware is just a 'breakin' of the same old exploits:   Break in and root kit, email with exec or email with a link and the user clicks on those/executes. The answer key is to perform frequent data backups. I recommend to use good infrastructure and education to deal with it:
 

    Make sure no users log on to any PC with an account that has Admin rights.
    Educate users on how to handle emails.
    Educate users on how to surf safely.
    Use application whitelisting.
    Apply regular backup.
    Keep backups offline.
    Test the backup.
    Deactivate unnecessary components/services.
    Disable unused user accounts.
    Patching the systems.
    Restrict host access to USB..etc.
    Apply Endpoint security.
    DNS Filtering.
    Install endpoint protection or endpoint security.

https://www.experts-exchange.com/articles/33451/Building-a-Robust-Security-Awareness-Program.html
https://www.experts-exchange.com/articles/31763/Incident-Handling-and-Response-Plan.html
https://www.experts-exchange.com/questions/29105848/Backup-Security-post-Ransomware-Incident.html?anchorAnswerId=42602937#a42602937
Your best bet is to restore from backup.

Websites like NoMoreRansom.org now provide decryption tools that may help you.

Also, avast has some tools as well, may you get help from their.

https://expert-advice.org/security/ways-to-protect-yourself-from-ransomware-attack/

https://www.experts-exchange.com/articles/29262/What-is-Ransomware-and-how-do-you-stop-it.html
This question needs an answer!
Become an EE member today
7 DAY FREE TRIAL
Members can start a 7-Day Free trial then enjoy unlimited access to the platform.
View membership options
or
Learn why we charge membership fees
We get it - no one likes a content blocker. Take one extra minute and find out why we block content.