A variant of the Petya ransomware has emerged recently, which has been renamed to Goldeneye, but shows almost no differences when compared to the original, security researchers warn.
Initially spotted in March this year, Petya became known because it didn’t encrypt user’s files, but modified the MBR (Master Boot Record) in a two-step process and denied access to the entire hard disk. A couple of months later, Petya’s authors decided to bundle the malware with a second ransomware, Mischa, which would kick in when Petya’s encryption process failed.
In July, the Petya-Mischa bundle had already inspired similar threats and was being sold as a Ransomware-as-a-Service (RaaS). While the malware’s behavior didn’t change between those updates, researchers noticed a major difference from the original modus operandi to the one employed by the latest variant using the Goldeneye name.
The ransomware is currently being distributed via resume-themed spam emails targeting enterprise users in Germany. Two attachments are included in the spam emails, one being a fake resume, while the other is an Excel spreadsheet that contains malicious macros designed to install the malware, BleepingComputer explains.
As soon as the victim enables the macros, embedded base64 strings are launched and saved into an executable file in the temp folder, which is then executed to start encrypting the files on the computer. Only after completing the encryption, the malware attempts to modify the MBR, which is the opposite of what Petya-Mischa did before, when they first attacked the MBR and only then encrypted files.
Goldeneye appends a random 8-character extension to the encrypted files, and then modifies the MBR with a custom boot loader. As soon as the encryption operation has been completed, a ransom note is displayed, but only for a short period of time, because the malware reboots the infected computer to encrypt the hard drive’s MFT (Master File Table) to deny access to files.
The ransom screen displayed by the new variant is almost identical to that used by Petya, with only one change made to it: the word “files” has been replaced with “harddisks,” Avira reveals. The text color was modified to yellow, after being red in the initial version and green after Mischa came into play. Goldeneye asks victims to pay a $1,000 ransom and directs users to a Dark Web portal that also includes a support area.
Related: Locky Variant Osiris Distributed via Excel Documents
Related: HDDCryptor Ransomware Variant Used in San Francisco Rail System Attack