The VirLocker ransomware is trying to rise from the dead yet again. When it appeared in 2014, VirLocker was thought to be the first instance of mainstream polymorphic ransomware. Now, Malwarebytes researchers have spotted a new and rather malicious variant of the 2-year-old malware.

Perverse Polymorphism

The variant operates in much the same way as the 2014 version did, taking a victim’s files and wrapping them inside an .exe shell. After the file is encrypted, it will show up as an executable.

The polymorphic nature of this ransomware makes it hard to detect using conventional techniques because it constantly changes its form. As a Malwarebytes researcher put it, “If the payload stub can be different each creation, and the encrypted code is always seeded different, the embedded original file will, of course, always be different … This leaves very little that is suitable for detection.”

Due to this continuous shift, it’s nearly impossible to generate a static signature or detection string that will work across all copies of VirLocker.

VirLocker Is Not Too Bright

There is some good news, however: Victims can trick this particular version of the malware into thinking that a ransom has been paid. It seems that although VirLocker can shapeshift with ease, it’s not too bright.

On the ransom page, there is a field labeled “Transfer ID.” Researchers discovered that if a victim enters any 64-bit number into the field, the malware will think it received payment. According to Bleeping Computer, simply entering 64 zeroes will do the trick.

Exactly why this method words remains unclear. But even with the workaround, much additional work is required to rescue the affected data. The malware is designed to spread rapidly, so it’s important to isolate an infected machine before attempting to repair it.

Picking Up the Pieces

A victim must tediously pick the individual recovered files out of the carnage after they are decrypted. The malware then repairs the hard disk, rather than simply taking the money and running.

VirLocker also makes many copies of itself, banking on victims to accidentally send it along with a file transfer. The researchers recommended backing up critical files and erasing the infected hard disk.

Users and researchers would be wise to keep on eye on this malware, since the next iteration may not be so easily fooled.