Petya ransomware made the rounds in summer 2016, and now it has re-emerged in a new form. Researchers from Kaspersky Lab recently found a variant of the potent Petya ransomware called PetrWrap. This Trojan is able directly use the core engine of Petya to deploy attacker-created encryption keys. It was seen in recent enterprise-focused attacks monitored by the lab.

Researchers found that this new Trojan totally bypasses the original creators of Petya. The malware payload in PetrWrap is different as well, although the researchers said that a functional Petya v3 is part of the payload. This version of Petya was most problematic because it included a well-functioning Salsa20 encryption.

A New Petya Ransomware

Actors behind the ransomware have found a way to insert encryption keys of their own choosing into Petya. That means the malware will use those keys for any encryption it tries to pull off instead of the ones specified by the original creators.

PetrWrap injects its own keys by first delaying the attack for 90 minutes, which gives it time to prepare and decrypt onboard resources. It then will substitute the elliptic curve Diffie-Hellman (ECDH) key with its own implementation of this module. This enables the use of PetrWrap’s own private and public keys in the burning and pillaging that follows infection.

Intercepting With Hooks

The malware injects two new hooks into Petya’s code that will intercept the original Salsa20-encrypted key. The malware then returns its own keys in real time when it needs to encrypt data. PetrWrap also constructs a new user ID to identify the victim.

Petya typically locks up the victim computer rather than expend energy to encrypt all the files on a system. The upstart malware removes the original Petya ransom note and replaces it with one redirecting the payment. This revised ransom note is the only thing that a victim computer will display, since at this point the master file table (MFT) has been encrypted.

Because the rest of the files besides the MFT may be unaffected, Kaspersky Lab recommended that victims of this malware try a third-party tool, such as R-Studio, to see if any files are recoverable. And as always, steering clear of possibly malicious emails, attachments and websites is a good way to avoid infection.