Petya-esque ransomware is spreading across the world

[msherwood]

UPDATE 6/29/2017 1045 PST: According to information uncovered within Malwarebytes Labs, we have determined that this ransomware variant is coded to erase a unique and randomly generated key that is used to encrypt the MFT (Master File Table).  The destruction of the Salsa20 key makes it very unlikely that users can receive a working decryption key – even after paying the attackers ransom demands. For this reason, we warn any infected user who may be considering paying the ransom to beware. We have created a new entry on the Malwarebytes blog with the newly discovered information: EternalPetya and the lost Salsa20 key

UPDATE 6/27/2017 1653 PST: Based on information released by security researchers, a Ukrainian accounting software company called Me Doc pushed an update at around 10:30 GMT this morning, which installed the malware on the “victim zero” system. Then, using a mix of PSExec, WMI, and EternalBlue, it was able to spread to every other computer on the network. Me Doc has claimed that this isn’t the case, however, so we won’t 100 perfect confirm that this was the source of the original infection vector.

At this point, it would be a good idea (if you are running any Me Doc software) to not update said software until they have announced that their servers are clean.

---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

UPDATE 6/27/2017 1515 PST: Researchers have discovered what might be a “Vaccine” for the current version of the Petya-Esque ransomworm. You can give it a shot and see if it works for you, but keep in mind that basically as soon as the linked article was created, the creators of this attack have likely already modified their source to negate the defense. Good luck!

---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

UPDATE 6/27/2017 1430 PST: If you’re thinking about paying the ransom for this threat–don’t bother. The e-mail service which hosted the address which victims were instructed to send payment to has closed the account. So, at this point trying to pay the ransom will result in a returned e-mail. Unfortunately, recovering files from payment is no longer possible at the moment, the attackers may provide their victims with alternative forms of payment transactions.

---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

Ringing with echoes of WanaCrypt0r, a new strain of ransomware being called Petya/NotPetya is impacting users around the world, shutting down firms in Ukraine, Britain, and Spain.

Background

Petya, created in July 2016, started off as one of the next-generation ransomware strains that utilizes an MBR (Master Boot Record) locker. In the early days of ransomware, strains that modified the startup of a system were popular, but they had died off for many years. Today, not long after its one year anniversary, Petya has come back with a vengeance and a nasty new distribution method.

As to whether or not this malware is the same Petya that we have dealt with in the past, many other researchers, including our own, claim that the malware is heavily influenced and likely developed by the creators of Petya. This malware has indicators and code that matches previous versions of Petya, but with additional functionality.

We are not going to claim attribution or even confirm what family we are dealing with until more analysis has been completed and more evidence is available. What we can say for sure is that this ransomware uses tactics rarely seen in the wild.

Infection vector

Taking a page out of WannaCry’s book, this new ransomware utilizes the same EternalBlue SMB exploit that was used in the outbreak that occurred more than a month ago. There are also currently reports that this attack uses email spam to distribute infected Office documents in efforts to rapidly spread and distribute the ransomware. This malware also includes the ability to use PSExec on a system it has administrative credentials on, allowing it to execute duplicates of the malware on any system on the network.

However, not all of these reports have been confirmed by Malwarebytes staff, so its true original infection vector beyond SMB exploitation is up in the air. But the combination of the PSExec method with the EternalBlue exploit gives this malware a lot of power in its ability to spread across a network.

Execution

After execution, the ransomware infects the system at a low level, modifying the MBR and presenting the user with the following prompt:

After a reboot, instead of loading into the operating system installed on the computer, the user is faced with a faux Check Disk operation that, instead of actually checking your hard disk for issues, is actually encrypting files! This is done to buy the ransomware more time to encrypt all the relevant files on the system without being stopped by the user.

The MFT (Master File Tree) and the MBR are also encrypted. The MBR is overwritten to display the ransom note, which makes it impossible to boot the system without remediation—meaning users must either pay the culprit or be unable to access their system. The computer will then display a menacing black screen with red lettering listing the ransomware’s purpose and its demands. The attack affects users by encrypting anywhere from a single file to the entire system.

While this situation could have been easily avoided by simply keeping all antivirus database and operating system updates current, the now-infected users must pay $300 in Bitcoins to regain access to their files.

 

As stated on Twitter by @ydklijnsma, it would appear that the file types being targeted are aimed more toward the programs that developers would use, such as, .vbs, .ova, .vbox, and so on. This makes it appear like target of these attacks are likely businesses and especially firms that specialize in software development.

Unfortunately, unlike WannaCry, Petya does not have a “killswitch” readily available or known.

Zero-hour protection

Malwarebytes detected this ransomware in the zero hour, meaning those that have Malwarebytes Premium or our standalone anti-ransomware technology have been protected from the instant this attack began. Both Malwarebytes business users and consumers users are protected if they are using the latest version of the above products.

We detect this ransomware as either Ransom.Petya or Ransom.Petya.EB

Full protection from this threat can also be achieved by:

• Updating and deploying security software with anti-ransomware capabilities
• Updating and securing operating systems on your network, including checking for any open SMB ports on any Internet-facing systems
• Locking down user accounts from having administrative powers and possibly even removing/shutting down admin systems that might utilize the PSExec method of spreading the malware
• If you are a business owner, making sure your users are aware of this current threat
• Opening emails with a high degree of scrutiny in the near future

We are going to regularly update this post to inform you about new developments with this attack, a deeper look at its spread, and possible motivations/infection methods. In addition, we are currently working on a post that analyzes the malware binary to its core. Expect that shortly.

Thanks for reading and safe surfing!

Edited June 29, 2017 by msherwood

[stanleykorn]

In the email that I received from Malwarebytes, it is stated that the free version of Malwarebytes does not protect against the Petya-esque ransomware. Yet you say in the same email that "Your safety is our number one priority." If our safety is indeed your number one priority, then why not include protection against ransomware in the free version of Malwarebytes?

[celee]

Hi @stanleykorn, 

If you had Malwarebytes Premium, you and your company would've been protected from yesterday's ransomware attack. Our real-time protection would have stopped the ransomware in its track.

Malwarebytes Free does not have real-time protection. On why you would need to pay for the Premium version, from our CEO back in 2014, which remains true today:

Quote

As more and more people have come to rely on us for malware protection and cleanup, our costs in bandwidth, hosting fees, infrastructure, salaries of our researchers, QA department and more have grown immensely.

Though our company is about more than just making money, we are a company and we do have to make money to pay our staff to continue doing what they love, which is fighting malware.

The subscription model will help us to be sustainable for the future while staying true to our roots that we will always make malware cleanup free for everyone.

If you're interested, we do have an Anti-Ransomware Beta at https://forums.malwarebytes.com/forum/172-anti-ransomware-beta/ that you can try out. 

[daman1]

On 6/28/2017 at 10:13 PM, stanleykorn said:

In the email that I received from Malwarebytes, it is stated that the free version of Malwarebytes does not protect against the Petya-esque ransomware. Yet you say in the same email that "Your safety is our number one priority." If our safety is indeed your number one priority, then why not include protection against ransomware in the free version of Malwarebytes?

Really? What do you expect for free? You think they're going to give away their product? Deals can be found all the time buy it and get full protection.