This article aims to help you learn more about the latest ransomware outbreak spreading Petya ransomware. It will also show you how to remove the latest Petya.A ransomware virus and restore access to your computer successfully.
Just when we thought something was learned from the massive WannaCry ransomware outbreak, there comes yet another virus like a blast from the past, using the same exploits as WCRY to spread. The malware is known by many as Petya ransomware and it does not encrypt files, but directly attacks the Master Boot Record of the infected computer to encrypt the sectors of it’s hard drive. The latest iteration of Petya, then poses as the notorious WannaCry virus by displaying very similar ransom note beggining with the same “Oops, Your Important Files Are Encrypted” ransom note. If you have become a victim of this version of Petya ransomware, we strongly urge you to the following material on the subject.
Threat Summary
| Name | Petya.A |
| Type | Ransomware |
| Short Description | Petya.A ransomware encrypts the MBR and then demands $300 for a ransom payoff to get the files back.. |
| Symptoms | The ransomware creates a lockscreen, named “Oops your important files are encrypted”. |
| Distribution Method | Spam Emails, Email Attachments, Executable Files |
| Detection Tool | See If Your System Has Been Affected by Petya.A Download Malware Removal Tool |
| User Experience | Join Our Forum to Discuss Petya.A. |
| Data Recovery Tool | Windows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive. |
Update July 2017! – The creator of Petya ransomware has offered help to victims by using his master key to partially unlock the drives.
How Does Petya.A Ransomware Infect
Very similar to WannaCry ransomware, the ones who are spreading this new variant Petya.A have focused on Worm infection via an exploit kit that is pretty familiar – ETERNALBLUE from the Shadow Brokers leak back in the beginning of 2017. This exploit is believed to be embedded within the worm infection and used in targeted attacks to organizations.
What is interesting about the worm is that it mostly targets Windows 7 systems, after which Windows XP and finally 10 and 8.1 which account to 8% of the attacks so far. It cannot be said who is behind the attack, but the Petya ransomware virus was offered for sale in the deep web with affiliate program. This means that anyone could have purchased and utilized the ransomware for their own profit. The ones who have put Petya ransomware up for sale have even created a user-friendly interface, making it possible for users with little experience to tamper with the ransomware and use it. However, this still leaves the issue with how the worm managed to infect multiple organizations, starting with ones located in Russia as well as Ukraine. The victims of the initial attacks have reported that once a system of the inner networks of their organization was infected, the virus has begun to infect all of the other systems within the network automatically, pointing out to a sophisticated worm infection.
Petya Ransomware – Technical Analysis
Petya.A ransomware is not limited to just one version. The first Petya ransomware attacks were spotted back In the early 2016. The virus displayed a skull and a red screen. After some time, a new variant came out, known as Mischa ransomware, which was a modified Petya variant. Later both variants were combined into one ransomware, that encrypts the MBR and if that fails, the virus encrypts the files on the compromised computer system.
Then, somewhere around December, 2016, a new, stronger version came out, calling itself GoldenEye ransomware, completing the doubts that the names of the viruses are from the James Bond movie – Golden Eye. The virus attacked the same way as Petya and Mischa and is still involved in the 2017 WannaCry like attacks as it was primarily detected in Ukraine.
And now we come up to the current point of the Petya.A attacks. Few months ago, malware researchers have detected a modified variant of Petya ransomware. It was created to attack organizations and it uses a stronger algorithm than the previously employed 16-byte key used by Petya.
The latest variant of Petya ransomware(Petya.A) may just be the previously detected PetrWrap ransomware which targets organizations. This means that it may perform the following activities on a machine, once it has infected it:
1) Initially immediately after infection, the Petya.A ransomware drops a malicious file, named petwrap.exe which causes a BSOD infection (Blue Screen of Death). After this, the virus immediately displays the following message, pretending to be a disk checked (DSKCHK):
2) Then, Petya begins encrypting the Kernel and the Master Boot Record of the infected computer. It has also been detected to attack he master file table (MFT) on NTFS volumes.
3) Upon infection it may contain an embedded public key, called master_pub
4) When each infection takes place, the virus may generate unique keys for every infected device to separate them. These keys are reported to be called ec_session_priv and ec_session_pub
5) The virus uses SHA516 in ECDH mode which contributes to the encryption of the Master Boot Record (MBR).
6) It also encrypts the decryption key, using another function, called ecdh_shared_digest.
7) The virus also generates a unique identifier to separate the single infection.
8) It all ends up with the lockscreen Petya.A sets on boot which has the following message:
“Ooops, your important files are encrypted.
If you see this text, then your files are no longer accessible, because they have been encrypted. Perhaps you are busy looking for a way to recover your
files, but don’t waste your time. Nobody can recover your files without our
decryption service.We guarantee that you can recover all your files safely and easily. All you
need to do is submit the payment and purchase the decryption key.Please follow the instructions:
1. Send $300 worth of Bitcoin to following address:
lflz7153HHuxXTuR2R1t78mGSdzafithBUX2. Send your Bitcoin wallet ID and personal installation key to e-mail
wowsmith1234569posteo.net. Your personal installation key:
{Unique Key}If you already purchased your key, please enter it below.
Key:_”
How to Try and Recover Drives By Petya.A Ransomware
The previous variant of Petya was indeed decryptable by using a software, called Petya Sector Extractor. Unfortunately, this is not the case with this petya ransomware variant. This is why, we have decided to create theoretical instructions to help you try and recover at least some of your important files. Here is what you will need to have for the instructions:
- A screwdriver, corresponding to your desktop/laptop.
- A secure computer that is scanned for malware and cleaned and has a proper ransomware protection.
- Patience.
First of all, you should choose the safe computer from which to scan your files to be a powerful Windows machine which is also secured. This is why we recommend following these steps to secure it:
1. Download an ransomware and malware protection program.
Spy Hunter scanner will only detect the threat. If you want the threat to be automatically removed, you need to purchase the full version of the anti-malware tool.Find Out More About SpyHunter Anti-Malware Tool / How to Uninstall SpyHunter
2. Download a relevant ransomware protection program.
3. Download a relevant cloud backup program that backups copies of your files on a secure server and even if your computer is affected you will stay protected. For more information you can also check another methods to safely store your data here.
After securing the test PC, you should prepare it for the decryption process which will most likely be lengthy. This is why we recommend changing the power settings so that your decryption computer does not automatically hibernate or sleep while left decrypting the drive.
→ Step 1: Click on the battery icon in your system tray (next to the digital clock) in Windows and then click on More Power Options.
Step 2:The Power options menu will appear. In your power plan click on Change Plan Settings.
Step 3: In your plan’s settings make sure you set “Turn off the display” and “Put computer to sleep” to “Never” from the drop down minutes menu.
Step 4: Click on Save Changes and close it.
Recovery Phase
For the recovery process, we have outlined several often-met drive migration scenarios which can be possible between different computers:
- From Laptop to Laptop with no extra components.
- From Desktop to Desktop with no extra components.
- From Laptop to Desktop with a SATA cable if the Desktop has an outdated chipset.
- From Desktop to Laptop with a SATA cable if the Laptop has a newer chipset.
To simplify the process, we recommend you to choose machines that do not require any extra cables or components for the drive to run on them. In case you do not have such possibility, we recommend using an external SATA-USB adapter.
Step 1: Remove battery and power from your laptop. For desktop computers, please remove eliminate the power from the contact.
Step 2: Using the screwdriver, unscrew the case which carries the hard drive. For laptops, you should follow these steps:
Step 3: Remove the hard drive again with the screwdriver. It will look similar to the one on the picture below:
Step 4: Plug-in the hard drive on a secure computer which has an internet connection and Windows installed and screw it in firmly. If connected directly, the hard drive should be detected by the OS as a separate partition, similar to the picture below:
Step 5: After you have connected the drive, you will likely not be able to open it, because it’s sectors are encrypted. However, because only some of the sectors are encrypted, enough to render the drive no longer openable, you may have a chance if you use a data recovery software to recover the files from the drive as you were scanning a lost partition. Most data recovery programs have support for scanning broken partitions, but we recommend you to try the following:
→ Stellar Phoenix Windows Data Recovery
Conclusion and Updates On Petya
We will continue to monitor the situation with Petya ransomware and update with every new variant coming out as we did with the previous Petya variant which was decrypted. Follow this web page or our blog news letter by e-mail for more information to come soon. In the meantime, we strongly advise you to update your Windows systems and secure them properly against malware. To learn more about security your PC and data in the future, we recommend reading the following materials:
→Related:Ransomware Protection Tips
→Related:Safely Store Your Important Files and Protect Them from Malware
So can we recover files encrypted by Petra?