Newly Discovered RedEye Ransomware spreading via Twitter and target the victims to encrypt the data and lock the file to demand the ransom amount in Bitcoin.
Also, RedEye Ransomware is capable of destroying the victim’s computer after the warning time to pay the ransom amount.
This New Ransomware variant created by the same author who is behind the Annabelle ransomware that was actively spreading earlier of this year.
The name RedEye was named by the ransomware author “iCoreX” and this ransomware demands the ransom amount in bitcoin through the Bitcoin wallet ID and the transaction should be made by Onion Payment portal.
RedEye Ransomware threatening the victims through Twitter and it asking to check out a “scary & really nasty” sample.
RedEye Ransomware Attack Vector
Once RedEye compromises the user then it drops a file with the size of 30 MB that contains several media files, specifically images and audio files, embedded in the binary.
A dropped file contains 3 “.wav” files: child.wav, redeye.wav, suicide.wav that play a “creepy” sound and the main intention of the sound to scare the user.
RedEye Ransomware author using few other tricks such as compression and packing to evade the detection.
Once it starts the execution process, initially it will disable task manager and in this iteration, will also hide your drives.
Later it will completely encryption all the victim files using Rijndael-Algorithms –AES – 256 Bit encryption algorithm and lock all the disk files.
After the successful completion of the encryption process, it will display the ransom notes with detailed information about what just could be happened in victims computer.
Ransom notes containing complete information about the payment and it demands to pay 0.1 Bitcoin($765 USD) to the given address.
According to the researcher, The ransomware has several options which I won’t be showing here, but in short, it can:
- Show encrypted files
- Decrypt files
- Support
- Destroy PC
The Destroy PC option shows a GIF as background where you have the option to select “Do it” and “Close”.
All the files RedEye Securely encrypt with AES256 and it appears to overwrite or fill files with 0 bytes, rendering the files useless and add the “.RedEye” Extension in end of all disk files.
It will lock the MBR(Master Boot Record) and destroy the complete system when the user selects “Do it” Option or the payment time has expired.
All Users are requested to:
- Install and keep NPAV updated up-to-date.
- Make sure NPAV Data Backup is ON.
- Always use trusted and secure sites for downloading setups.
Net Protector customers are protected from such new and dangerous ransomware.
Source:- gbhackers.com