January 30, 2017 By Larry Loeb 2 min read

The VirLocker ransomware is trying to rise from the dead yet again. When it appeared in 2014, VirLocker was thought to be the first instance of mainstream polymorphic ransomware. Now, Malwarebytes researchers have spotted a new and rather malicious variant of the 2-year-old malware.

Perverse Polymorphism

The variant operates in much the same way as the 2014 version did, taking a victim’s files and wrapping them inside an .exe shell. After the file is encrypted, it will show up as an executable.

The polymorphic nature of this ransomware makes it hard to detect using conventional techniques because it constantly changes its form. As a Malwarebytes researcher put it, “If the payload stub can be different each creation, and the encrypted code is always seeded different, the embedded original file will, of course, always be different … This leaves very little that is suitable for detection.”

Due to this continuous shift, it’s nearly impossible to generate a static signature or detection string that will work across all copies of VirLocker.

VirLocker Is Not Too Bright

There is some good news, however: Victims can trick this particular version of the malware into thinking that a ransom has been paid. It seems that although VirLocker can shapeshift with ease, it’s not too bright.

On the ransom page, there is a field labeled “Transfer ID.” Researchers discovered that if a victim enters any 64-bit number into the field, the malware will think it received payment. According to Bleeping Computer, simply entering 64 zeroes will do the trick.

Exactly why this method words remains unclear. But even with the workaround, much additional work is required to rescue the affected data. The malware is designed to spread rapidly, so it’s important to isolate an infected machine before attempting to repair it.

Picking Up the Pieces

A victim must tediously pick the individual recovered files out of the carnage after they are decrypted. The malware then repairs the hard disk, rather than simply taking the money and running.

VirLocker also makes many copies of itself, banking on victims to accidentally send it along with a file transfer. The researchers recommended backing up critical files and erasing the infected hard disk.

Users and researchers would be wise to keep on eye on this malware, since the next iteration may not be so easily fooled.

More from

CISA hit by hackers, key systems taken offline

3 min read - The Cybersecurity and Infrastructure Security Agency (CISA) — responsible for cybersecurity and infrastructure protection across all levels of the United States government — has been hacked.“About a month ago, CISA identified activity indicating the exploitation of vulnerabilities in Ivanti products the agency uses,” a CISA spokesperson announced.In late February, CISA had already issued a warning that cyber threat actors are exploiting previously identified vulnerabilities in Ivanti Connect Secure and Ivanti Policy Secure gateways. Ivanti Connect Secure is a widely deployed…

Cloud security evolution: Years of progress and challenges

7 min read - Over a decade since its advent, cloud computing continues to enable organizational agility through scalability, efficiency and resilience. As clients shift from early experiments to strategic workloads, persistent security gaps demand urgent attention even as providers expand infrastructure safeguards.The prevalence of cloud-native services has grown exponentially over the past decade, with cloud providers consistently introducing a multitude of new services at an impressive pace. Now, the contemporary cloud environment is not only larger but also more diverse. Unfortunately, that size…

PixPirate: The Brazilian financial malware you can’t see

10 min read - Malicious software always aims to stay hidden, making itself invisible so the victims can’t detect it. The constantly mutating PixPirate malware has taken that strategy to a new extreme. PixPirate is a sophisticated financial remote access trojan (RAT) malware that heavily utilizes anti-research techniques. This malware’s infection vector is based on two malicious apps: a downloader and a droppee. Operating together, these two apps communicate with each other to execute the fraud. So far, IBM Trusteer researchers have observed this…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today