Itís hard enough for non-technical users to deal with ransomware infections: understanding public-key cryptography, connecting to the Tor anonymity network and paying with Bitcoin cryptocurrency. A new malicious program now makes it even more difficult by completely locking victims out of their computers.
The new Petya ransomware overwrites the master boot record (MBR) of the affected PCs, leaving their operating systems in an unbootable state, researchers from antivirus firm Trend Micro said in a blog post.
The MBR is the code stored in the first sectors of a hard disk drive. It contains information about the diskís partitions and launches the operating systemís boot loader. Without a proper MBR, the computer doesnít know which partitions contain an OS and how to start it.
Trend Micro researchers say Petya is distributed through spam emails that masquerade as job applications. This suggests that its creators target businesses in particular, with the messages being directed at human resources departments.
The emails have a link to a shared Dropbox folder that contains a self-extracting archive posing as the applicantís CV and a fake photo. If the archive is downloaded and executed, the ransomware is installed.
The malicious program will rewrite the computerís MBR and and will trigger a critical Windows error that will cause the computer to rebootóa condition known as a Blue Screen of Death (BSOD).
Following this initial reboot, the rogue MBR code will display a fake Windows check disk operation that normally occurs after a hard disk error, according to computer experts from popular tech support forum BleepingComputer.com.
During this operation, the ransomware actually encrypts the master file table (MFT). This is a special file on NTFS partitions that contains information about every other file: their name, size and mapping to the hard disk sectors...