March 16, 2017 By Larry Loeb 2 min read

Petya ransomware made the rounds in summer 2016, and now it has re-emerged in a new form. Researchers from Kaspersky Lab recently found a variant of the potent Petya ransomware called PetrWrap. This Trojan is able directly use the core engine of Petya to deploy attacker-created encryption keys. It was seen in recent enterprise-focused attacks monitored by the lab.

Researchers found that this new Trojan totally bypasses the original creators of Petya. The malware payload in PetrWrap is different as well, although the researchers said that a functional Petya v3 is part of the payload. This version of Petya was most problematic because it included a well-functioning Salsa20 encryption.

A New Petya Ransomware

Actors behind the ransomware have found a way to insert encryption keys of their own choosing into Petya. That means the malware will use those keys for any encryption it tries to pull off instead of the ones specified by the original creators.

PetrWrap injects its own keys by first delaying the attack for 90 minutes, which gives it time to prepare and decrypt onboard resources. It then will substitute the elliptic curve Diffie-Hellman (ECDH) key with its own implementation of this module. This enables the use of PetrWrap’s own private and public keys in the burning and pillaging that follows infection.

Intercepting With Hooks

The malware injects two new hooks into Petya’s code that will intercept the original Salsa20-encrypted key. The malware then returns its own keys in real time when it needs to encrypt data. PetrWrap also constructs a new user ID to identify the victim.

Petya typically locks up the victim computer rather than expend energy to encrypt all the files on a system. The upstart malware removes the original Petya ransom note and replaces it with one redirecting the payment. This revised ransom note is the only thing that a victim computer will display, since at this point the master file table (MFT) has been encrypted.

Because the rest of the files besides the MFT may be unaffected, Kaspersky Lab recommended that victims of this malware try a third-party tool, such as R-Studio, to see if any files are recoverable. And as always, steering clear of possibly malicious emails, attachments and websites is a good way to avoid infection.

More from

How will the Merck settlement affect the insurance industry?

3 min read - A major shift in how cyber insurance works started with an attack on the pharmaceutical giant Merck. Or did it start somewhere else?In June 2017, the NotPetya incident hit some 40,000 Merck computers, destroying data and forcing a months-long recovery process. The attack affected thousands of multinational companies, including Mondelēz and Maersk. In total, the malware caused roughly $10 billion in damage.NotPetya malware exploited two Windows vulnerabilities: EternalBlue, a digital skeleton key leaked from the NSA, and Mimikatz, an exploit…

3 Strategies to overcome data security challenges in 2024

3 min read - There are over 17 billion internet-connected devices in the world — and experts expect that number will surge to almost 30 billion by 2030.This rapidly growing digital ecosystem makes it increasingly challenging to protect people’s privacy. Attackers only need to be right once to seize databases of personally identifiable information (PII), including payment card information, addresses, phone numbers and Social Security numbers.In addition to the ever-present cybersecurity threats, data security teams must consider the growing list of data compliance laws…

ICS CERT predictions for 2024: What you need to know

4 min read - As we work through the first quarter of 2024, various sectors are continuously adapting to increasingly complex cybersecurity threats. Sectors like healthcare, finance, energy and transportation are all regularly widening their digital infrastructure, resulting in larger attack surfaces and greater risk exposure.Kaspersky just released their ICS CERT Predictions for this year, outlining the key cybersecurity challenges industrial enterprises will face in the year ahead. The forecasts emphasize the persistent nature of ransomware threats, the increasing prevalence of cosmopolitical hacktivism, insights…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today