Security-X
Forum Security-X => Sécurité Générale => Malwares => Discussion démarrée par: chantal11 le avril 09, 2016, 16:17:48
-
Bonjour,
Une fiche Malwarebytes sur le ransomware Petya :
Petya – Taking Ransomware To The Low Level | Malwarebytes Labs (https://blog.malwarebytes.org/threat-analysis/2016/04/petya-ransomware/)
Petya is different from the other popular ransomware these days. Instead of encrypting files one by one, it denies access to the full system by attacking low-level structures on the disk. This ransomware’s authors have not only created their own boot loader but also a tiny kernel, which is 32 sectors long.
Petya’s dropper writes the malicious code at the beginning of the disk. The affected system’s master boot record (MBR) is overwritten by the custom boot loader that loads a tiny malicious kernel. Then, this kernel proceeds with further encryption. Petya’s ransom note states that it encrypts the full disk, but this is not true. Instead, it encrypts the master file table (MFT) so that the file system is not readable.
PREVENTION TIP: Petya is most dangerous in Stage 2 of the infection, which starts when the affected system is being rebooted after the BSOD caused by the dropper. In order to prevent your computer from going automatically to this stage, turn off automatic restart after a system failure (see how to do this).
If you detect Petya in Stage 1, your data can still be recovered. More information about it is [here] and in this article.