Is this encrypted-protected files safe from Ransomware?
If a .txt file is encrypted, SMB produces the same file with this extension ". txt-[Encrypted]", it becomes blanc icon.
The original file loses its attributes and you cannot open/access to it according to. txt extension.
In my opinion these files cannot be accessed by ransomware.
View attachment 114684
I'm not sure what functions exactly use every ransomware, if its purely the real extension that is retrieve, the files created this way can be ignored by ransomware.
By function that searches for the beginning of extension like
*.txt (like when you search for all files with this extension using windows search), the part after seems to be ignored / not important, so a list of files can be returned if the beginning is recognized.
For encryption, file is just used as binary data, a method to memorize the real extension is used, and the name of the files found (returned on a list by *.extension) is given as parameter, but in this case if a check is done, may be a ransomware should ignore them, not sure.
It would be interesting to test with VM and .jpg files modified this way