Securify

Recently a new variant of Crysis/Dharma Ransomware has been identified, and based on its ID, it is confirmed to be a new Crysis variant. This new version appends the .cobra extension to encrypted files. It is not known exactly how this variant is being distributed, but in the past Crysis ransomware was spread by hacking into Remote Desktop Services and manually installing the ransomware.

How it works

Once the variant is installed, it scans a computer for data files and encrypts them. When encrypting a file, it appends an extension in the format of .id-[id].[email].cobra

It should be noted that this ransomware will encrypt both mapped and unmapped network shares, so it’s important to ensure that network shares are locked down so that only those who actually need access have permission. When this Crysis variant encrypts a computer, it also deletes all of the shadow volume copies on the machine so they cannot be used to recover the unencrypted files, by running the vssadmin delete shadows /all /quiet command.

This variant of Crysis ransomware also creates two different ransom notes on the infected computer. When a user logs into the computer, the info.hta file is launched via autorun. The other note, Files encrypted!!.txt, can be found on the desktop. Both ransom notes contain instructions for making payment and who to contact.

Finally, the ransomware configures itself to start automatically at Windows login, allowing it to encrypt new files created since it was last executed. At this time it is not possible to decrypt .cobra files for free. The only way to recover encrypted files is via a backup, or through Shadow Volume Copies — though Crysis does attempt to remove these, in rare cases the infection fails to do so.

Recommendations

• If you are using Remote Desktop Services, do not connect it directly to the internet — make it accessible only via a VPN.
• Always have a backup.
• Do not open attachments if you do not know who sent them.
• Make sure all Windows updates are installed as soon as they’re released. Also keep other programs updated, especially Java, Flash, and Adobe Reader — older versions contain security vulnerabilities commonly exploited by malware distributors.
• Use strong passwords and never reuse the same password across multiple sites.

References

• Fortinet Threat Research — Dharma Ransomware: What It’s Teaching Us