Knowledge (XXG)

Kirk Ransomware

Source 📝

147:, and informing the user that files have been "encrypted using military grade encryption." "SPOCK TO THE RESCUE!" the ransom note continues, and demands payment in order to receive a decryptor program named Spock. The ransom demanded is initially 50 Monero (worth about $ 1,175 as of March 2017); if not paid within 48 hours, the demand begins increasing, reaching 500 Monero after two weeks. If the ransom remains unpaid after 30 days, the decryption key is deleted, essentially rendering the encryption irreversible. The ransom note includes a spurious quotation from Spock ("Logic, motherfucker"), and ends with " 29: 729: 749: 349: 306: 415: 901: 441: 719: 376: 187: 663: 260: 327: 281: 709: 478: 222: 833: 1247: 714: 1381: 1363: 864: 642: 408: 1387: 913: 874: 509: 688: 1447: 1393: 968: 859: 795: 632: 534: 854: 627: 143: 1899: 734: 446: 436: 401: 1608: 998: 785: 724: 683: 581: 1103: 838: 601: 158:. Monero has significantly greater privacy protection than bitcoin, making transactions much more difficult to trace. 1884: 1792: 1133: 988: 780: 673: 617: 1273: 1242: 869: 114: 1904: 1411: 978: 896: 802: 775: 118: 106: 154:
Kirk Ransomware is the first known ransomware to demand payment in Monero; most other ransomware has demanded
1567: 1231: 704: 637: 483: 86: 1441: 1297: 1128: 790: 1582: 1417: 1201: 565: 1345: 1226: 938: 647: 596: 591: 121:. Once activated, Kirk Ransomware searches the infected computer's hard drive for files with certain 110: 1889: 1844: 1716: 744: 560: 1894: 1854: 1849: 1746: 1375: 1138: 1064: 754: 555: 238: 122: 63: 129:
to the end of their filenames. When the encryption is finished, a window pops up, displaying an
1859: 1741: 1711: 1315: 1171: 529: 493: 218: 161:
A variant of Kirk Ransomware, named Lick Ransomware, was also discovered; it does not contain
1787: 1639: 1562: 1211: 1148: 1023: 472: 1797: 1736: 1664: 1577: 1572: 1216: 1008: 918: 622: 215:
Handbook of Research on Information and Cyber Security in the Fourth Industrial Revolution
1536: 1531: 1221: 1206: 1196: 1191: 1123: 1098: 1093: 1088: 1033: 488: 83: 350:"Missed the bitcoin boom? Five more baffling cryptocurrencies to blow your savings on" 82:. It encrypts files on an infected computer and demands payment for decryption in the 1878: 1659: 1118: 1077: 1073: 1069: 148: 134: 282:"Kirk ransomware sports Star Trek-themed decryptor and little-known crypto-currency" 1603: 1557: 1357: 1321: 1176: 1166: 1059: 1054: 1049: 923: 739: 668: 354: 1839: 1829: 1777: 1685: 1629: 1541: 1490: 1351: 1181: 908: 539: 377:"The Week in Ransomware – March 17th 2017 – Revenge, PetrWrap, and Captain Kirk" 328:"Kirk ransomware – A Star Trek Themed Ransomware that requests Monero payments" 1782: 1767: 1695: 1485: 1435: 1339: 1291: 1267: 1255: 1113: 1038: 1028: 1018: 1003: 963: 888: 519: 90: 48: 28: 1813: 1690: 1654: 1644: 1516: 1333: 1083: 1013: 953: 514: 130: 188:"Star Trek Themed Kirk Ransomware Brings us Monero and a Spock Decryptor!" 1721: 1649: 1634: 1453: 1429: 1303: 1285: 1186: 1108: 943: 928: 828: 807: 586: 261:"Spock will unlock Kirk ransomware – after you beam up a bunch of Monero" 1751: 1624: 1587: 1521: 1500: 1470: 1423: 1405: 1327: 1261: 1043: 958: 948: 933: 393: 155: 79: 1834: 1726: 1680: 1495: 1309: 1279: 1158: 1143: 973: 812: 524: 1459: 1399: 1369: 678: 138: 94: 1731: 1526: 770: 397: 239:"Shameless crooks fling Star Trek-themed ransomware at world" 710:
Hollywood Presbyterian Medical Center ransomware incident
1822: 1806: 1760: 1704: 1673: 1617: 1596: 1550: 1509: 1478: 1469: 1240: 1157: 987: 887: 847: 821: 763: 697: 656: 610: 574: 548: 502: 465: 458: 59: 54: 44: 21: 750:Russian interference in the 2016 U.S. elections 409: 307:"Star Trek-themed Kirk ransomware discovered" 8: 720:Democratic National Committee cyber attacks 1475: 664:Office of Personnel Management data breach 462: 416: 402: 394: 27: 125:, and encrypts and renames them, adding 330:. Cyber Defense Magazine. 22 March 2017 174: 18: 16:Ransomware malware, discovered in 2017 300: 298: 208: 206: 204: 7: 182: 180: 178: 715:Commission on Elections data breach 379:. Bleepingcomputer.com. 2017-03-18 190:. Bleepingcomputer.com. 2017-03-16 14: 875:Jeff Bezos phone hacking incident 284:. Grahamcluley.com. 17 March 2017 93:was first discovered in 2017, by 1448:Microarchitectural Data Sampling 684:Ukrainian Power Grid Cyberattack 592:Cyberterrorism attack of June 25 348:Hern, Alex (December 11, 2017). 796:2017 Ukraine ransomware attacks 633:2014 JPMorgan Chase data breach 628:2014 celebrity nude photo leak 144:Star Trek: The Original Series 1: 865:Bulgarian revenue agency hack 643:Russian hacker password theft 999:Bangladesh Black Hat Hackers 475:(publication of 2009 events) 259:Bremner, Bill (2017-03-24). 109:program that masquerades as 860:Baltimore ransomware attack 305:Ms. Smith (19 March 2017). 217:. IGI Global. p. 105. 97:researcher Jakub Kroustek. 1921: 1134:Tailored Access Operations 781:WannaCry ransomware attack 674:Ashley Madison data breach 618:Anthem medical data breach 535:PlayStation network outage 241:. The Register. 2017-03-17 113:, an application used for 870:WhatsApp snooping scandal 735:Indian Bank data breaches 429: 119:denial-of-service attacks 40: 35: 26: 1412:Speculative Store Bypass 979:Ukrainian Cyber Alliance 776:2017 Macron e-mail leaks 786:Westminster data breach 705:Bangladesh Bank robbery 648:2014 Yahoo! data breach 638:2014 Sony Pictures hack 597:2013 Yahoo! data breach 582:South Korea cyberattack 484:Operation Olympic Games 479:Australian cyberattacks 36:Part of the ransom note 1129:Syrian Electronic Army 839:SingHealth data breach 602:Singapore cyberattacks 540:RSA SecurID compromise 213:Fields, Ziska (2018). 1418:Lazy FP state restore 1202:Kristoffer von Hassel 855:Sri Lanka cyberattack 725:Vietnam Airport Hacks 566:Operation High Roller 149:LIVE LONG AND PROSPER 135:Captain James T. Kirk 105:Kirk Ransomware is a 1900:Hacking in the 2010s 1364:Silent Bob is Silent 424:Hacking in the 2010s 111:Low Orbit Ion Cannon 1298:SS7 vulnerabilities 834:Atlanta cyberattack 803:Equifax data breach 561:Stratfor email leak 510:Canadian government 489:Operation ShadowNet 123:filename extensions 1747:Petya and NotPetya 1376:ROCA vulnerability 1139:The Shadow Brokers 1065:Iranian Cyber Army 991:persistent threats 791:Petya and NotPetya 755:2016 Bitfinex hack 730:DCCC cyber attacks 689:SWIFT banking hack 1885:2017 in computing 1872: 1871: 1868: 1867: 1860:ZeroAccess botnet 1172:Mustafa Al-Bassam 939:New World Hackers 902:associated events 883: 882: 679:VTech data breach 530:Operation AntiSec 494:Operation Payback 453: 452: 224:978-1-5225-4764-8 69: 68: 55:Technical details 1912: 1476: 1149:Yemen Cyber Army 473:Operation Aurora 463: 432: 431: 418: 411: 404: 395: 388: 387: 385: 384: 373: 367: 366: 364: 362: 345: 339: 338: 336: 335: 324: 318: 317: 315: 314: 302: 293: 292: 290: 289: 278: 272: 271: 269: 268: 256: 250: 249: 247: 246: 235: 229: 228: 210: 199: 198: 196: 195: 184: 128: 31: 19: 1920: 1919: 1915: 1914: 1913: 1911: 1910: 1909: 1905:Windows trojans 1875: 1874: 1873: 1864: 1818: 1802: 1756: 1700: 1669: 1613: 1592: 1546: 1505: 1465: 1245: 1243:vulnerabilities 1236: 1153: 1046:(confederation) 1009:Charming Kitten 990: 983: 919:Goatse Security 879: 843: 817: 808:Deloitte breach 759: 745:Dyn cyberattack 693: 652: 623:Operation Tovar 606: 570: 544: 498: 459:Major incidents 454: 425: 422: 392: 391: 382: 380: 375: 374: 370: 360: 358: 347: 346: 342: 333: 331: 326: 325: 321: 312: 310: 304: 303: 296: 287: 285: 280: 279: 275: 266: 264: 258: 257: 253: 244: 242: 237: 236: 232: 225: 212: 211: 202: 193: 191: 186: 185: 176: 171: 126: 103: 72:Kirk Ransomware 22:Kirk Ransomware 17: 12: 11: 5: 1918: 1916: 1908: 1907: 1902: 1897: 1892: 1887: 1877: 1876: 1870: 1869: 1866: 1865: 1863: 1862: 1857: 1852: 1847: 1842: 1837: 1832: 1826: 1824: 1820: 1819: 1817: 1816: 1810: 1808: 1804: 1803: 1801: 1800: 1795: 1790: 1785: 1780: 1775: 1770: 1764: 1762: 1758: 1757: 1755: 1754: 1749: 1744: 1739: 1734: 1729: 1724: 1719: 1714: 1708: 1706: 1702: 1701: 1699: 1698: 1693: 1688: 1683: 1677: 1675: 1671: 1670: 1668: 1667: 1662: 1657: 1652: 1647: 1642: 1637: 1632: 1630:Black Energy 3 1627: 1621: 1619: 1615: 1614: 1612: 1611: 1606: 1600: 1598: 1594: 1593: 1591: 1590: 1585: 1580: 1575: 1570: 1565: 1560: 1554: 1552: 1548: 1547: 1545: 1544: 1539: 1537:Metulji botnet 1534: 1529: 1524: 1519: 1513: 1511: 1507: 1506: 1504: 1503: 1498: 1493: 1491:Black Energy 2 1488: 1482: 1480: 1473: 1467: 1466: 1464: 1463: 1457: 1451: 1445: 1439: 1433: 1427: 1421: 1415: 1409: 1403: 1397: 1391: 1385: 1379: 1373: 1367: 1361: 1355: 1349: 1346:Broadcom Wi-Fi 1343: 1337: 1331: 1325: 1319: 1313: 1307: 1301: 1295: 1289: 1283: 1277: 1271: 1265: 1259: 1252: 1250: 1238: 1237: 1235: 1234: 1229: 1224: 1219: 1214: 1209: 1207:Junaid Hussain 1204: 1199: 1197:Jeremy Hammond 1194: 1192:Elliott Gunton 1189: 1184: 1179: 1174: 1169: 1163: 1161: 1155: 1154: 1152: 1151: 1146: 1141: 1136: 1131: 1126: 1124:Stealth Falcon 1121: 1116: 1111: 1106: 1101: 1099:PLA Unit 61486 1096: 1094:PLA Unit 61398 1091: 1089:Numbered Panda 1086: 1081: 1067: 1062: 1057: 1052: 1047: 1041: 1036: 1034:Equation Group 1031: 1026: 1021: 1016: 1011: 1006: 1001: 995: 993: 985: 984: 982: 981: 976: 971: 966: 961: 956: 951: 946: 941: 936: 931: 926: 921: 916: 911: 906: 905: 904: 893: 891: 885: 884: 881: 880: 878: 877: 872: 867: 862: 857: 851: 849: 845: 844: 842: 841: 836: 831: 825: 823: 819: 818: 816: 815: 810: 805: 800: 799: 798: 788: 783: 778: 773: 767: 765: 761: 760: 758: 757: 752: 747: 742: 737: 732: 727: 722: 717: 712: 707: 701: 699: 695: 694: 692: 691: 686: 681: 676: 671: 666: 660: 658: 654: 653: 651: 650: 645: 640: 635: 630: 625: 620: 614: 612: 608: 607: 605: 604: 599: 594: 589: 584: 578: 576: 572: 571: 569: 568: 563: 558: 552: 550: 546: 545: 543: 542: 537: 532: 527: 525:HBGary Federal 522: 517: 512: 506: 504: 500: 499: 497: 496: 491: 486: 481: 476: 469: 467: 460: 456: 455: 451: 450: 444: 439: 430: 427: 426: 423: 421: 420: 413: 406: 398: 390: 389: 368: 340: 319: 294: 273: 251: 230: 223: 200: 173: 172: 170: 167: 115:stress testing 102: 99: 84:cryptocurrency 67: 66: 61: 57: 56: 52: 51: 46: 45:Classification 42: 41: 38: 37: 33: 32: 24: 23: 15: 13: 10: 9: 6: 4: 3: 2: 1917: 1906: 1903: 1901: 1898: 1896: 1893: 1891: 1888: 1886: 1883: 1882: 1880: 1861: 1858: 1856: 1853: 1851: 1848: 1846: 1843: 1841: 1838: 1836: 1833: 1831: 1828: 1827: 1825: 1821: 1815: 1812: 1811: 1809: 1805: 1799: 1796: 1794: 1791: 1789: 1786: 1784: 1781: 1779: 1776: 1774: 1771: 1769: 1766: 1765: 1763: 1759: 1753: 1750: 1748: 1745: 1743: 1740: 1738: 1735: 1733: 1730: 1728: 1725: 1723: 1720: 1718: 1715: 1713: 1710: 1709: 1707: 1703: 1697: 1694: 1692: 1689: 1687: 1684: 1682: 1679: 1678: 1676: 1672: 1666: 1663: 1661: 1660:Gameover ZeuS 1658: 1656: 1653: 1651: 1648: 1646: 1643: 1641: 1638: 1636: 1633: 1631: 1628: 1626: 1623: 1622: 1620: 1616: 1610: 1607: 1605: 1602: 1601: 1599: 1595: 1589: 1586: 1584: 1581: 1579: 1576: 1574: 1571: 1569: 1566: 1564: 1561: 1559: 1556: 1555: 1553: 1549: 1543: 1540: 1538: 1535: 1533: 1530: 1528: 1525: 1523: 1520: 1518: 1515: 1514: 1512: 1508: 1502: 1499: 1497: 1494: 1492: 1489: 1487: 1484: 1483: 1481: 1477: 1474: 1472: 1468: 1461: 1458: 1455: 1452: 1449: 1446: 1443: 1440: 1437: 1434: 1431: 1428: 1425: 1422: 1419: 1416: 1413: 1410: 1407: 1404: 1401: 1398: 1395: 1392: 1389: 1386: 1383: 1380: 1377: 1374: 1371: 1368: 1365: 1362: 1359: 1356: 1353: 1350: 1347: 1344: 1341: 1338: 1335: 1332: 1329: 1326: 1323: 1320: 1317: 1314: 1311: 1308: 1305: 1302: 1299: 1296: 1293: 1290: 1287: 1284: 1281: 1278: 1275: 1272: 1269: 1266: 1263: 1260: 1257: 1254: 1253: 1251: 1249: 1244: 1239: 1233: 1230: 1228: 1225: 1223: 1220: 1218: 1215: 1213: 1210: 1208: 1205: 1203: 1200: 1198: 1195: 1193: 1190: 1188: 1185: 1183: 1180: 1178: 1175: 1173: 1170: 1168: 1165: 1164: 1162: 1160: 1156: 1150: 1147: 1145: 1142: 1140: 1137: 1135: 1132: 1130: 1127: 1125: 1122: 1120: 1119:Rocket Kitten 1117: 1115: 1112: 1110: 1107: 1105: 1102: 1100: 1097: 1095: 1092: 1090: 1087: 1085: 1082: 1079: 1075: 1071: 1070:Lazarus Group 1068: 1066: 1063: 1061: 1058: 1056: 1053: 1051: 1048: 1045: 1042: 1040: 1037: 1035: 1032: 1030: 1027: 1025: 1022: 1020: 1017: 1015: 1012: 1010: 1007: 1005: 1002: 1000: 997: 996: 994: 992: 986: 980: 977: 975: 972: 970: 967: 965: 962: 960: 957: 955: 952: 950: 947: 945: 942: 940: 937: 935: 932: 930: 927: 925: 922: 920: 917: 915: 912: 910: 907: 903: 900: 899: 898: 895: 894: 892: 890: 886: 876: 873: 871: 868: 866: 863: 861: 858: 856: 853: 852: 850: 846: 840: 837: 835: 832: 830: 827: 826: 824: 820: 814: 813:Disqus breach 811: 809: 806: 804: 801: 797: 794: 793: 792: 789: 787: 784: 782: 779: 777: 774: 772: 769: 768: 766: 762: 756: 753: 751: 748: 746: 743: 741: 738: 736: 733: 731: 728: 726: 723: 721: 718: 716: 713: 711: 708: 706: 703: 702: 700: 696: 690: 687: 685: 682: 680: 677: 675: 672: 670: 667: 665: 662: 661: 659: 655: 649: 646: 644: 641: 639: 636: 634: 631: 629: 626: 624: 621: 619: 616: 615: 613: 609: 603: 600: 598: 595: 593: 590: 588: 587:Snapchat hack 585: 583: 580: 579: 577: 573: 567: 564: 562: 559: 557: 556:LinkedIn hack 554: 553: 551: 547: 541: 538: 536: 533: 531: 528: 526: 523: 521: 518: 516: 513: 511: 508: 507: 505: 501: 495: 492: 490: 487: 485: 482: 480: 477: 474: 471: 470: 468: 464: 461: 457: 449: → 448: 445: 443: 440: 438: 435:←  434: 433: 428: 419: 414: 412: 407: 405: 400: 399: 396: 378: 372: 369: 357: 356: 351: 344: 341: 329: 323: 320: 308: 301: 299: 295: 283: 277: 274: 262: 255: 252: 240: 234: 231: 226: 220: 216: 209: 207: 205: 201: 189: 183: 181: 179: 175: 168: 166: 164: 159: 157: 152: 150: 146: 145: 140: 136: 132: 124: 120: 116: 112: 108: 100: 98: 96: 92: 88: 85: 81: 77: 73: 65: 62: 58: 53: 50: 47: 43: 39: 34: 30: 25: 20: 1772: 1604:CryptoLocker 1358:DoublePulsar 1177:Cyber Anakin 1167:Ryan Ackroyd 1060:Helix Kitten 1055:Hacking Team 1050:Guccifer 2.0 924:Lizard Squad 740:Surkov leaks 669:Hacking Team 381:. Retrieved 371: 359:. Retrieved 355:The Guardian 353: 343: 332:. Retrieved 322: 311:. Retrieved 309:. CSO Online 286:. Retrieved 276: 265:. Retrieved 254: 243:. Retrieved 233: 214: 192:. Retrieved 165:references. 162: 160: 153: 142: 107:trojan horse 104: 75: 71: 70: 1840:NetTraveler 1778:LogicLocker 1686:Hidden Tear 1583:Red October 1442:Dragonblood 1352:EternalBlue 1316:Stagefright 1182:George Hotz 1159:Individuals 909:CyberBerkut 101:Description 1890:Ransomware 1879:Categories 1783:Rensenware 1768:BrickerBot 1696:TeslaCrypt 1486:Bad Rabbit 1436:Foreshadow 1340:Cloudbleed 1292:Row hammer 1274:Shellshock 1268:Heartbleed 1256:Evercookie 1232:The Jester 1114:Red Apollo 1074:BlueNorOff 1044:GOSSIPGIRL 1039:Fancy Bear 1029:Elfin Team 1024:DarkMatter 1019:Dark Basin 1004:Bureau 121 964:Teamp0ison 889:Hacktivism 520:DNSChanger 383:2020-01-04 334:2020-01-04 313:2020-01-04 288:2020-01-04 267:2020-01-04 245:2020-01-04 194:2020-01-04 169:References 91:ransomware 60:Written in 49:Ransomware 1895:Star Trek 1814:VPNFilter 1691:Rombertik 1655:FinFisher 1645:DarkHotel 1609:DarkSeoul 1517:Coreflood 1382:BlueBorne 1334:Dirty COW 1248:disclosed 1246:publicly 1084:NSO Group 1014:Cozy Bear 954:PayPal 14 897:Anonymous 771:SHAttered 515:DigiNotar 163:Star Trek 133:image of 131:ASCII art 1855:Titanium 1798:XafeCopy 1793:WannaCry 1722:KeRanger 1650:Duqu 2.0 1635:Carbanak 1454:BlueKeep 1430:SigSpoof 1388:Meltdown 1304:WinShock 1286:Rootpipe 1187:Guccifer 1109:Pranknet 1104:PLATINUM 1078:AndAriel 989:Advanced 944:NullCrew 929:LulzRaft 829:Trustico 442:Timeline 263:. Sophos 156:bitcoins 1752:X-Agent 1742:Pegasus 1625:Brambul 1588:Shamoon 1532:Kelihos 1522:Alureon 1501:Stuxnet 1471:Malware 1424:TLBleed 1406:Exactis 1394:Spectre 1328:Badlock 1262:iSeeYou 1227:Topiary 959:RedHack 949:OurMine 934:LulzSec 127:.kirked 80:malware 1835:Joanap 1788:Triton 1727:Necurs 1717:Jigsaw 1712:Hitler 1681:Dridex 1640:Careto 1563:Dexter 1496:SpyEye 1462:(2019) 1456:(2019) 1450:(2019) 1444:(2019) 1438:(2018) 1432:(2018) 1426:(2018) 1420:(2018) 1414:(2018) 1408:(2018) 1402:(2018) 1396:(2018) 1390:(2018) 1384:(2017) 1378:(2017) 1372:(2017) 1366:(2017) 1360:(2017) 1354:(2017) 1348:(2017) 1342:(2017) 1336:(2016) 1330:(2016) 1324:(2016) 1318:(2015) 1312:(2015) 1310:JASBUG 1306:(2014) 1300:(2014) 1294:(2014) 1288:(2014) 1282:(2014) 1280:POODLE 1276:(2014) 1270:(2014) 1264:(2013) 1258:(2010) 1241:Major 1222:Track2 1144:xDedic 974:UGNazi 361:May 7, 221:  89:. The 87:Monero 64:Python 1850:Tinba 1737:Mirai 1665:Regin 1578:Mahdi 1573:Flame 1558:Carna 1542:Stars 1460:Kr00k 1400:EFAIL 1370:KRACK 1322:DROWN 447:2020s 437:2000s 141:from 139:Spock 95:Avast 78:, is 74:, or 1845:R2D2 1830:Grum 1823:2019 1807:2018 1773:Kirk 1761:2017 1732:MEMZ 1705:2016 1674:2015 1618:2014 1597:2013 1551:2012 1527:Duqu 1510:2011 1479:2010 1217:Sabu 969:TDO 914:GNAA 848:2019 822:2018 764:2017 698:2016 657:2015 611:2014 575:2013 549:2012 503:2011 466:2010 363:2020 219:ISBN 151:". 137:and 117:and 76:Kirk 1568:FBI 1212:MLT 1076:) ( 1881:: 352:. 297:^ 203:^ 177:^ 1080:) 1072:( 417:e 410:t 403:v 386:. 365:. 337:. 316:. 291:. 270:. 248:. 227:. 197:.

Index


Ransomware
Python
malware
cryptocurrency
Monero
ransomware
Avast
trojan horse
Low Orbit Ion Cannon
stress testing
denial-of-service attacks
filename extensions
ASCII art
Captain James T. Kirk
Spock
Star Trek: The Original Series
LIVE LONG AND PROSPER
bitcoins



"Star Trek Themed Kirk Ransomware Brings us Monero and a Spock Decryptor!"



ISBN
978-1-5225-4764-8
"Shameless crooks fling Star Trek-themed ransomware at world"
"Spock will unlock Kirk ransomware – after you beam up a bunch of Monero"

Text is available under the Creative Commons Attribution-ShareAlike License. Additional terms may apply.