Petya ransomware overwrites MBRs, locking users out of their computers

The ransomware is distributed by emails masquerading as job applications

It's hard enough for non-technical users to deal with ransomware infections: understanding public-key cryptography, connecting to the Tor anonymity network and paying with Bitcoin cryptocurrency. A new malicious program now makes it even more difficult by completely locking victims out of their computers.

The new Petya ransomware overwrites the master boot record (MBR) of the affected PCs, leaving their operating systems in an unbootable state, researchers from antivirus firm Trend Micro said in a blog post.

The MBR is the code stored in the first sectors of a hard disk drive. It contains information about the disk's partitions and launches the operating system's boot loader. Without a proper MBR, the computer doesn't know which partitions contain an OS and how to start it.

Trend Micro researchers say Petya is distributed through spam emails that masquerade as job applications. This suggests that its creators target businesses in particular, with the messages being directed at human resources departments.

The emails have a link to a shared Dropbox folder that contains a self-extracting archive posing as the applicant's CV and a fake photo. If the archive is downloaded and executed, the ransomware is installed.

The malicious program will rewrite the computer's MBR and and will trigger a critical Windows error that will cause the computer to reboot -- a condition known as a Blue Screen of Death (BSOD).

Following this initial reboot, the rogue MBR code will display a fake Windows check disk operation that normally occurs after a hard disk error, according to computer experts from popular tech support forum BleepingComputer.com.

During this operation, the ransomware actually encrypts the master file table (MFT). This is a special file on NTFS partitions that contains information about every other file: their name, size and mapping to the hard disk sectors.

Petya does not encrypt the file data itself, which would take a long time for an entire hard drive, but by encrypting the MFT the OS will no longer know where the files are located on disk. The file data can still be read with data recovery applications, but rebuilding the actual files would likely be a lengthy and inexact process, especially in the case of fragmented files that are spread across different storage blocks in different regions of the disk.

After the MFT encryption is done, the rogue Petya MBR code will display the ransom message accompanied by a skull drawn in ASCII characters. The message instructs users to access the attackers' decryption site on the Tor anonymity network and provides them with a unique code that identifies their computer.

The price for the key required to decrypt the MFT is 0.99 bitcoins (BTC), or around US$430.

For now, the Petya spam campaign was seen targeting companies from Germany, but there's no guarantee that it will remain localized. In fact most ransomware attacks begin in a country or region and then grow to a global scale as the attackers gain more resources.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Cool Tech

Toys for Boys

Family Friendly

Stocking Stuffer

SmartLens - Clip on Phone Camera Lens Set of 3

Learn more >

Christmas Gift Guide

Click for more ›

Brand Post

Bitdefender 2019

This Holiday Season, protect yourself and your loved ones with the best. Buy now for Holiday Savings!

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Michael Hargreaves

Microsoft Office 365/Dell XPS 15 2-in-1

I’d recommend a Dell XPS 15 2-in-1 and the new Windows 10 to anyone who needs to get serious work done (before you kick back on your couch with your favourite Netflix show.)

Maryellen Rose George

Brother PT-P750W

It’s useful for office tasks as well as pragmatic labelling of equipment and storage – just don’t get too excited and label everything in sight!

Cathy Giles

Brother MFC-L8900CDW

The Brother MFC-L8900CDW is an absolute stand out. I struggle to fault it.

Luke Hill

MSI GT75 TITAN

I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Laura Johnston

MSI GS65 Stealth Thin

If you can afford the price tag, it is well worth the money. It out performs any other laptop I have tried for gaming, and the transportable design and incredible display also make it ideal for work.

Featured Content

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?