{"id":68533,"date":"2017-02-13T23:50:13","date_gmt":"2017-02-14T07:50:13","guid":{"rendered":"https:\/\/securingtomorrow.mcafee.com\/?p=68533"},"modified":"2025-05-27T20:29:34","modified_gmt":"2025-05-28T03:29:34","slug":"analyzing-killdisk-ransomware-part-2-variants-screen-unlocking","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/analyzing-killdisk-ransomware-part-2-variants-screen-unlocking\/","title":{"rendered":"Analyzing KillDisk Ransomware, Part 2: Variants and Screen Unlocking"},"content":{"rendered":"

This blog post was written by Sudhanshu Dubey.<\/em><\/p>\n

At McAfee Labs we recently analyzed the ransomware KillDisk.\u00a0In part 1<\/a> of this analysis, we discussed the basics of the\u00a0malware and its whitelisting to protect itself. In this part, we will provide more information about the malware’s internals, this variant, and steps to unlock\u00a0the ransomware lock screen.<\/p>\n

Variant 1.\u00a0<\/strong>This variant seems to be inspired by the TV series \u201cMr. Robot.\u201d The lock screen uses the string \u201cWe are fSociety\u201d:<\/p>\n

The KillDisk ransom note.<\/em><\/p>\n

While analyzing the encryption process of this variant, we observed some strange behavior. In contrast to Variant 2, this one behaved more like a destroyer, overwriting all the files with specific\u00a0bytes. This step makes the data irrecoverable. Hence this variant\u2019s block screen has no payment information. Instead, it appeals to victims to join them.<\/p>\n

Variant 2.\u00a0<\/strong>This variant works like normal ransomware, encrypting data files. It keeps the encrypted data in each locked file along with some more bytes including an infection marker. For more information about this variant, refer to\u00a0Part 1<\/a> of this post.<\/p>\n

Analysis<\/strong><\/h2>\n

Although the encryption of both the variants is different, they show the same arguments and behavior based on those arguments. We found three arguments, which we shall discuss.<\/p>\n

    \n
  • -set<\/strong><\/li>\n
  • -est<\/strong><\/li>\n
  • -opt<\/strong><\/li>\n<\/ul>\n

    KillDisk\u00a0uses these arguments in key-value pairs and checks the values for the given key.<\/p>\n

    -est.\u00a0<\/strong>The value of this argument is in minutes. This argument is used to store the “current time + minutes” in the registry.<\/p>\n

    -set.\u00a0<\/strong>This argument is used to create service and registry entries. It receives the value in Date#Time format (for example, “-set=20.12.2016#05:00”) to fill the registry entry it creates. Before proceeding, it tries to get the handle of the event using OpenEvent() API, to check whether the malware is already executed. The event name has the following format:<\/p>\n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Global\\{CLSID}<\/strong><\/p>\n

    If the malware\u00a0finds the event, it first cleans up the registry and deletes the service. It then recreates the service and the registry with updated values.<\/p>\n

    The malware\u00a0uses the WinExec() API to execute the sc command, which creates a service whose binary path is set to itself, along with argument -opt=svc. (We will explain later.)<\/p>\n

    Calling WinExec() to create a service.<\/em><\/p>\n

    Both variants have different service names. The following screenshots show the services created by the variants.<\/p>\n

    Services installed by KillDisk (both variants).<\/em><\/p>\n

    Comparing the registry keys created by the variants, we infer that they have different names and paths. But the data in the registry values are the same and have been filled using the same method. KillDisk uses \u2013set and \u2013est argument values passed to the executable. It creates three registry values that store time, in TimeStamp format, that is, seconds since 1\/1\/1970.\u00a0Here is more information about registry values:<\/p>\n

    First registry value \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 : \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0Current time<\/p>\n

    Second registry value \u00a0 \u00a0 \u00a0 \u00a0: \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0Time given with -set argument<\/p>\n

    Third registry value \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 : \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0Current time + minutes given in -est argument<\/p>\n

    The following screenshot shows the registry entries created by the malware when executing with the arguments -set=20.12.2016#05:00 -est=1440:<\/p>\n

    Registry entries.<\/em><\/p>\n

    Both the variants use different registry path, key and value names.<\/p>\n

    -opt.\u00a0<\/strong>This argument has five values:<\/p>\n

      \n
    • frc<\/li>\n
    • chk<\/li>\n
    • cnc<\/li>\n
    • svc<\/li>\n
    • pic<\/li>\n<\/ul>\n

      The malware’s behavior depends on the values of this argument, which the malware keeps in encrypted form. Before comparing the argument values, KillDisk first decrypts them. The following code snippet shows the decryption and comparison of argument values:<\/p>\n

      Decrypting and comparing -opt argument values.<\/em><\/p>\n

      Let\u2019s see how the malware behaves with different argument values.<\/p>\n

      -opt=pic.\u00a0<\/strong>This value leads to the creation of the ransom note and locking the screen. The malware imports functions from GDI32.dll and User32.dll to design the image. It opens a window using the CreateWindow() API and then creates the image over it. The following code snippet from Variant 2 draws the ransom message on the screen:<\/p>\n

      Ransom note creation code in Variant 2.\u00a0RGB (255, 83, 0) is a shade of orange.<\/em><\/p>\n

      After creating the ransom note, KillDisk starts a thread that keeps the window always on top by using the SetWindowPos() and SetForegroundWindow() APIs with specific arguments. The following code keeps the ransom note on top:<\/p>\n

      The\u00a0HWND_TOPMOST flag places the window above all non-topmost windows, even after the window is deactivated.<\/em><\/p>\n

      -opt=frc.\u00a0<\/strong>This value triggers the encryption process. Variant 1, the destroyer malware, overrides the files with 0x100 bytes that contain either the string “mrR0b07” or “fS0cie7y,” both inspired by the TV series “Mr. Robot.” The following screenshot shows the infected files:<\/p>\n

      Files infected files by Variant 2.<\/em><\/p>\n

      Before overwriting the files, the malware ensures that it has full access to the file. To get the access rights, it uses the Windows tool icacls.exe to modify the Access Control Lists for files and folders:<\/p>\n

      Modifying the Access Control List for all files from C drive.<\/em><\/p>\n

        \n
      • \/T \u00a0=> \u00a0Traverse all subfolders<\/li>\n
      • \/C \u00a0=> \u00a0Continue on file errors<\/li>\n
      • \/Q =>\u00a0 Quiet, suppress success messages<\/li>\n
      • \/grant user: permission<\/em> => \u00a0Grant access rights to the user, F: Full access<\/li>\n<\/ul>\n

        This variant also creates 50MB garbage files (filled with null) on the Windows drive, to fill up the disk space. To keep the garbage files, it creates a folder at the root of the Windows drive with a CLSID name. To hide them from victims, the malware keeps the folder attribute to system hidden.<\/p>\n

        -opt=cnc.\u00a0<\/strong>This value is used to clean the malware from the system. It uses the ControlService() API to send a stop signal to the service and the QueryServiceConfigA() API to get the file path from the service properties. The malware then deletes the registry entries and service from the system and also deletes the file.<\/p>\n

        -opt=chk.\u00a0<\/strong>This value is likely to be used during debugging. It checks for the service and registry entries, and then prints accordingly.<\/p>\n

        -opt=svc.\u00a0<\/strong>This value is given to the application while installing the service. It leads to the execution of the service handler function, registered through the RegisterServiceCtrlHandler() API. While debugging the code, we can see the code that executes commands to ping the local host and then delete itself with the help of the WinExec() API:<\/p>\n

        WinExec() executes commands to ping and delete itself.<\/em><\/p>\n

        On restarting, this malware deletes itself but it does not remove the service and remains installed.<\/p>\n

        Unlocking the screen<\/strong><\/p>\n

        We successfully bypassed the ransom note block screen with the help of \u201cWindows key + tab\u201d feature, which is available in Windows 7 and later versions.<\/p>\n

        To use this technique, you’ll need Window 7 or later infected with KillDisk, a keyboard connected to the system, and good eyes. (You have to look carefully.)<\/p>\n

        Here are the steps to unlock the blocking screen of KillDisk:<\/p>\n

        Step 1:<\/strong> Press Windows Key + Tab. You will be prompted with the open applications window.<\/p>\n

        Step 2:<\/strong> Press \u201cWindows Key + D\u201d or switch to the desktop using Step 1.<\/p>\n

        Step 3:<\/strong> Open \u201crun\u201d using \u201cWindows key + R\u201d and check whether you have the run window using Step 1.<\/p>\n

        Step 4:<\/strong> Type \u201ccmd\u201d and hit enter. You will get the command prompt; confirm using Step 1.<\/p>\n

        Step 5:<\/strong> Type \u201ctasklist\u201d and Hit\u00a0enter.<\/p>\n

        Step 6:<\/strong> Using \u201cWindows Key + Tab,\u201d check the process name on the list. (Good eyes needed.)<\/p>\n

        Because the malware killed all the other processes, it is likely all the processes will appear in a single command window. If not, change the command prompt size using the following command:<\/p>\n

        \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0<\/strong>mode con: cols=Value lines=Value \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0<\/strong> \/\/ Update “Value” to fit your display<\/p>\n

        Step 7:<\/strong> After getting the process list, identify the malware process from the output of tasklist. If you know the malware process name, good. Otherwise you have to check the running processes from the whitelist previously mentioned and select the process that is not on the list. (That will likely be the malware process.)<\/p>\n

        Step 8:<\/strong> Get the PID of the malware process from the second column of the tasklist output.<\/p>\n

        Step 9:<\/strong> After getting the malware PID, kill the process using the following command:<\/p>\n

        \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0Taskkill \/PID Malware_PID \/F<\/strong><\/p>\n

        After following these steps successfully, you will get your system back but the files will still be encrypted. This technique might work on other ransomware.<\/p>\n

        Conclusion<\/strong><\/h2>\n

        KillDisk is new to the world of ransomware. It has implemented a whitelisting technique to protect itself. We have discussed its internal working and a way to unlock the screen locked by ransomware.<\/p>\n

        McAfee products detect all known variants of this malware.<\/p>\n","protected":false},"excerpt":{"rendered":"

        This blog post was written by Sudhanshu Dubey. At McAfee Labs we recently analyzed the ransomware KillDisk.\u00a0In part 1 of…<\/p>\n","protected":false},"author":695,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[442],"tags":[76,338,180,4549],"coauthors":[4136],"class_list":["post-68533","post","type-post","status-publish","format-standard","hentry","category-mcafee-labs","tag-cybercrime","tag-endpoint-protection","tag-malware","tag-ransomware"],"acf":[],"yoast_head":"\nAnalyzing KillDisk Ransomware, Part 2: Variants and Screen Unlocking | McAfee Blog<\/title>\n<meta name=\"description\" content=\"This blog post was written by Sudhanshu Dubey. At McAfee Labs we recently analyzed the ransomware KillDisk.\u00a0In part 1 of this analysis, we discussed the\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Analyzing KillDisk Ransomware, Part 2: Variants and Screen Unlocking | McAfee Blog\" \/>\n<meta property=\"og:description\" content=\"This blog post was written by Sudhanshu Dubey. At McAfee Labs we recently analyzed the ransomware KillDisk.\u00a0In part 1 of this analysis, we discussed the\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/analyzing-killdisk-ransomware-part-2-variants-screen-unlocking\/\" \/>\n<meta property=\"og:site_name\" content=\"McAfee Blog\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/McAfee\/\" \/>\n<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/McAfee\/\" \/>\n<meta property=\"article:published_time\" content=\"2017-02-14T07:50:13+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-05-28T03:29:34+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/01\/KillDisk-Ransom-note-1024x470.png\" \/>\n<meta name=\"author\" content=\"McAfee Labs\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@McAfee_Labs\" \/>\n<meta name=\"twitter:site\" content=\"@McAfee\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"McAfee Labs\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"7 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/analyzing-killdisk-ransomware-part-2-variants-screen-unlocking\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/analyzing-killdisk-ransomware-part-2-variants-screen-unlocking\/\"},\"author\":{\"name\":\"McAfee Labs\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/86f325fa6532a017d06d6b49a2f3b1ad\"},\"headline\":\"Analyzing KillDisk Ransomware, Part 2: Variants and Screen Unlocking\",\"datePublished\":\"2017-02-14T07:50:13+00:00\",\"dateModified\":\"2025-05-28T03:29:34+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/analyzing-killdisk-ransomware-part-2-variants-screen-unlocking\/\"},\"wordCount\":1396,\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"keywords\":[\"cybercrime\",\"endpoint protection\",\"malware\",\"ransomware\"],\"articleSection\":[\"McAfee Labs\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/analyzing-killdisk-ransomware-part-2-variants-screen-unlocking\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/analyzing-killdisk-ransomware-part-2-variants-screen-unlocking\/\",\"name\":\"Analyzing KillDisk Ransomware, Part 2: Variants and Screen Unlocking | McAfee Blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\"},\"datePublished\":\"2017-02-14T07:50:13+00:00\",\"dateModified\":\"2025-05-28T03:29:34+00:00\",\"description\":\"This blog post was written by Sudhanshu Dubey. At McAfee Labs we recently analyzed the ransomware KillDisk.\u00a0In part 1 of this analysis, we discussed the\",\"breadcrumb\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/analyzing-killdisk-ransomware-part-2-variants-screen-unlocking\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/analyzing-killdisk-ransomware-part-2-variants-screen-unlocking\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/analyzing-killdisk-ransomware-part-2-variants-screen-unlocking\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Blog\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Other Blogs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"McAfee Labs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/\"},{\"@type\":\"ListItem\",\"position\":4,\"name\":\"Analyzing KillDisk Ransomware, Part 2: Variants and Screen Unlocking\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"name\":\"McAfee Blog\",\"description\":\"Internet Security News\",\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\",\"name\":\"McAfee\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"width\":1286,\"height\":336,\"caption\":\"McAfee\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/McAfee\/\",\"https:\/\/x.com\/McAfee\",\"https:\/\/www.linkedin.com\/company\/mcafee\/\",\"https:\/\/www.youtube.com\/McAfee\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/86f325fa6532a017d06d6b49a2f3b1ad\",\"name\":\"McAfee Labs\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/af947d76ffbef8521094b476cf8050c3\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/07\/Social-Media-PF-Logo-Pic-300x300-2-96x96.jpg\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/07\/Social-Media-PF-Logo-Pic-300x300-2-96x96.jpg\",\"caption\":\"McAfee Labs\"},\"description\":\"McAfee Labs is one of the leading sources for threat research, threat intelligence, and cybersecurity thought leadership. See our blog posts below for more information.\",\"sameAs\":[\"https:\/\/www.linkedin.com\/company\/mcafee\/\",\"https:\/\/www.facebook.com\/McAfee\/\",\"https:\/\/x.com\/McAfee_Labs\"],\"url\":\"https:\/\/www.mcafee.com\/blogs\/author\/mcafee-labs\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Analyzing KillDisk Ransomware, Part 2: Variants and Screen Unlocking | McAfee Blog","description":"This blog post was written by Sudhanshu Dubey. At McAfee Labs we recently analyzed the ransomware KillDisk.\u00a0In part 1 of this analysis, we discussed the","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"og_locale":"en_US","og_type":"article","og_title":"Analyzing KillDisk Ransomware, Part 2: Variants and Screen Unlocking | McAfee Blog","og_description":"This blog post was written by Sudhanshu Dubey. At McAfee Labs we recently analyzed the ransomware KillDisk.\u00a0In part 1 of this analysis, we discussed the","og_url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/analyzing-killdisk-ransomware-part-2-variants-screen-unlocking\/","og_site_name":"McAfee Blog","article_publisher":"https:\/\/www.facebook.com\/McAfee\/","article_author":"https:\/\/www.facebook.com\/McAfee\/","article_published_time":"2017-02-14T07:50:13+00:00","article_modified_time":"2025-05-28T03:29:34+00:00","og_image":[{"url":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/01\/KillDisk-Ransom-note-1024x470.png","type":"","width":"","height":""}],"author":"McAfee Labs","twitter_card":"summary_large_image","twitter_creator":"@McAfee_Labs","twitter_site":"@McAfee","twitter_misc":{"Written by":"McAfee Labs","Est. reading time":"7 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/analyzing-killdisk-ransomware-part-2-variants-screen-unlocking\/#article","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/analyzing-killdisk-ransomware-part-2-variants-screen-unlocking\/"},"author":{"name":"McAfee Labs","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/86f325fa6532a017d06d6b49a2f3b1ad"},"headline":"Analyzing KillDisk Ransomware, Part 2: Variants and Screen Unlocking","datePublished":"2017-02-14T07:50:13+00:00","dateModified":"2025-05-28T03:29:34+00:00","mainEntityOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/analyzing-killdisk-ransomware-part-2-variants-screen-unlocking\/"},"wordCount":1396,"publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"keywords":["cybercrime","endpoint protection","malware","ransomware"],"articleSection":["McAfee Labs"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/analyzing-killdisk-ransomware-part-2-variants-screen-unlocking\/","url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/analyzing-killdisk-ransomware-part-2-variants-screen-unlocking\/","name":"Analyzing KillDisk Ransomware, Part 2: Variants and Screen Unlocking | McAfee Blog","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/#website"},"datePublished":"2017-02-14T07:50:13+00:00","dateModified":"2025-05-28T03:29:34+00:00","description":"This blog post was written by Sudhanshu Dubey. At McAfee Labs we recently analyzed the ransomware KillDisk.\u00a0In part 1 of this analysis, we discussed the","breadcrumb":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/analyzing-killdisk-ransomware-part-2-variants-screen-unlocking\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/analyzing-killdisk-ransomware-part-2-variants-screen-unlocking\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/analyzing-killdisk-ransomware-part-2-variants-screen-unlocking\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https:\/\/www.mcafee.com\/blogs\/"},{"@type":"ListItem","position":2,"name":"Other Blogs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/"},{"@type":"ListItem","position":3,"name":"McAfee Labs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/"},{"@type":"ListItem","position":4,"name":"Analyzing KillDisk Ransomware, Part 2: Variants and Screen Unlocking"}]},{"@type":"WebSite","@id":"https:\/\/www.mcafee.com\/blogs\/#website","url":"https:\/\/www.mcafee.com\/blogs\/","name":"McAfee Blog","description":"Internet Security News","publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.mcafee.com\/blogs\/#organization","name":"McAfee","url":"https:\/\/www.mcafee.com\/blogs\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","width":1286,"height":336,"caption":"McAfee"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/McAfee\/","https:\/\/x.com\/McAfee","https:\/\/www.linkedin.com\/company\/mcafee\/","https:\/\/www.youtube.com\/McAfee"]},{"@type":"Person","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/86f325fa6532a017d06d6b49a2f3b1ad","name":"McAfee Labs","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/af947d76ffbef8521094b476cf8050c3","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/07\/Social-Media-PF-Logo-Pic-300x300-2-96x96.jpg","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/07\/Social-Media-PF-Logo-Pic-300x300-2-96x96.jpg","caption":"McAfee Labs"},"description":"McAfee Labs is one of the leading sources for threat research, threat intelligence, and cybersecurity thought leadership. See our blog posts below for more information.","sameAs":["https:\/\/www.linkedin.com\/company\/mcafee\/","https:\/\/www.facebook.com\/McAfee\/","https:\/\/x.com\/McAfee_Labs"],"url":"https:\/\/www.mcafee.com\/blogs\/author\/mcafee-labs\/"}]}},"_links":{"self":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/68533","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/users\/695"}],"replies":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/comments?post=68533"}],"version-history":[{"count":4,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/68533\/revisions"}],"predecessor-version":[{"id":214505,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/68533\/revisions\/214505"}],"wp:attachment":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/media?parent=68533"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/categories?post=68533"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/tags?post=68533"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/coauthors?post=68533"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}