Ryuk Ransomware evolution avoid encrypting Linux folders

Experts spotted a new strain of the Ryuk Ransomware that was developed to avoid encrypting folders commonly seen in *NIX operating systems.

Recently the City of New Orleans was the victim of ransomware attack, researchers from the BleepingComputer community revealed that the malware that infected the City’s systems was the Ryuk Ransomware. The experts found on the infected systems an executable named v2.exe.

The popular malware researcher Vitali Kremez that analyzed the sample involved in the attack discovered a new feature implemented in this new variant of malware. Kremez noticed that the ransomware doesn’t encrypt folders that are associated with *NIX operating systems.

2019-12-21: 👾#Ryuk #Ransomware 👁‍🗨as V2.EXE
🚨Alert: Watch Out During Holiday Season!
1⃣-encrypt (-e) Cmd
2⃣Crypter:
runtimecrypt
3⃣Similar (or Same?) to New Orleans Gov Intrusion (also as V2.exe)
4⃣Blacklisted *UNIX Folder System (🆕'er)
MD5: b0817e2a931d4cb950403b87d1f9cd8c pic.twitter.com/HVRskyxikj

— Vitali Kremez (@VK_Intel) December 22, 2019

The researcher noticed that this variant of the Ryuk ransomware doesn’t encrypt files in the following *NIX folders:

bin
boot
Boot
dev
etc
lib
initrd
sbin
sys
vmlinuz
run
var

“At first glance, it seems strange that a Windows malware would blacklist *NIX folders when encrypting files.” reported BleepingComputer.

“A Linux/Unix variant of Ryuk does not exist”

Experts pointed out that known variants of the Ryuk ransomware only targets Windows systems, anyway, Windows 10 implements the Windows Subsystem for Linux (WSL) feature that allows users to install various Linux distributions directly in Windows. The installs utilize folders with the same blacklisted names and likely attackers were not interested in encrypting the *NIX system folders used by WSL to avoid impacting the functionality of the operating system. Don’t forget that the main goal of ransomware is encrypting data without impacting the underlying operating system.

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – Ryuk ransomware, malware)

[adrotate banner=”5″]

[adrotate banner=”13″]