29/06/2017
https://www.welivesecurity.com/2017/06/27/new-ransomware-attack-hits-ukraine/
Petya Basic info----
Petya is different from the other popular ransomware these days. Instead of encrypting files one by one, it denies access to the full system by attacking low-level structures on the disk. This ransomware’s authors have not only created their own boot loader but also a tiny kernel, which is 32 sectors long.
---attack vector--
The installer for Petya/Mischa is distributed via phishing emails containing what appear to be job applications. These emails contain a link to a cloud storage service that contains an image of the supposed applicant and a downloadable executable that looks like a PDF. Once the executable is downloaded, it will have a PDF icon to make it appear as a PDF resume. This executable, though, when started tries to install Petya, and if that fails, installs the Mischa Ransomware.
Mischa then scans the computer for data files and encrypts them with the AES algorithm and adds an extension to the file name. This ransomware not only encrypts standard file types like PNGs, DOCXs, etc. but also goes after .EXE files.
Petya’s dropper writes the malicious code at the beginning of the disk. The affected system’s master boot record (MBR) is overwritten by the custom boot loader that loads a tiny malicious kernel. Then, this kernel proceeds with further encryption. Petya’s ransom note states that it encrypts the full disk, but this is not true. Instead, it encrypts the master file table (MFT) so that the file system is not readable.
Numerous reports are coming out on social media about a new ransomware attack in Ukraine, which could be related to the Petya family.