Ransomware Advanced Analysis

This playbook detects the ransomware type and searches for available decryptors. The playbook uses the ID-Ransomware service, which allows you to detect the ransomware using multiple methods.

Core · 12 tasks · 0 inputs · 0 outputs

Commands used

extractIndicators rasterize-email

Flowchart

Yes Yes Start Start Done Done Get ransomware note - Manual Get ransomware note - Manual Read the ransomware note - ReadFile Read the ransomware note ReadFile Rasterize the ransomware note - rasterize-email Rasterize the ransomware ... rasterize-email Upload the ransomware note Upload the ransomware note Were the files uploaded successfully? Were the files uploaded s... ID-Ransomware Enrichment ID-Ransomware Enrichment Search decryptor using the ransomware URL Search decryptor using th... Was the ransomware identified successfully? Was the ransomware identi... Test the decryptor Test the decryptor Extract indicator from the ransomware note - extractIndicators Extract indicator from th... extractIndicators