A new type of malware has been described, one that takes crypto-extortion to a new level. While most cryptographic ransomware variants are selective about what they encrypt—leaving the computer usable to make it easier for the victim to pay—this new entry targets the victim’s entire startup drive, encrypting the master file table (MFT).
Called Petya, the new ransomware is just the latest ransomware deliberately tailored for victims within organizations with IT support instead of a broader audience. As BleepingComputer’s Lawrence Abrams documented, Petya is currently being delivered via Dropbox links in e-mail messages targeting human resources departments at companies in Germany. The links are purported to be to an application to be installed by the HR employee.
RELATED: 15 Signs You Could Be a Tax Scam Victim
Running the attachment throws up a Windows alert; if the user clicks to continue, Petya is inserted into the master boot record (MBR) of the victim’s computer, and the system restarts. On reboot, the malware performs a fake Windows CHKDSK, warning “One of your disks contains errors and needs to be repaired,” Petya then flashes up an ASCII skull and crossbones on a red and white screen, announcing “You became victim of the PETYA RANSOMWARE!”
The screen then displays instructions on how to obtain a key to restore the disk through one of two Tor hidden service (.onion) sites. In Abrams’ walkthrough of the site, the attackers demanded 0.90294 Bitcoins in ransom to restore the drive (about $373 at current Bitcoin value).
Currently, the only way to recover from Petya is to pay up. Abrams warned that some Internet sites claimed that Petya could be fixed by repairing the affected drive’s MBR. “Though this will indeed remove the lock screen,” Abrams noted, “it will not decrypt your MFT and thus your files and Windows will still be inaccessible. Only repair the MBR if you do not care about any lost data and want to reinstall Windows.”
RELATED: Is EMV Pushing Fraud Online?
Fabian Scherschel of Heise Security has written an analysis (in German) of Petya, and has found that the “encryption” used by Petya in its first phase is a simple fixed-value XOR of the Master Boot Record. Caught at this step, the data can be easily be recovered by booting from another drive and backing up the contents. On UEFI systems infected by Petya, the malware may just damage the boot information, making the drive unbootable–but not encrypting its contents.
Are you a victim of fraud or money scam? Share your story with us on the Money Credit and You Facebook page!
Article and photo credit: ARS Technnica
