from SANS Internet Storm Center, InfoCON: green
Phishme is reporting the discovery of a new ransomware which its creators have named Bart. Bart shares several commonalities with the Locky ransomware. Bart is delivered by the same downloader, RockLoader. The payment site bares a striking resemblance to the Locky page.
But Bart also deviates from Locky in other ways. The ransom is much higher, 3 Bitcoins, approximately $2000. But probably the most striking difference is that unlike most ransomware variants Bart does not require a command and control to facilitate the encryption and in fact looks like it has no command and control capability. Bart does not utilize the complex public-private key or symmetric encryption methods that have become common in ransomware. Instead it stores the encrypted files in password protected zip files, and utilizes a victim id and a tor-based payment website to facilitate decryption.
This lack of a sophisticated encryption mechanism appears to be a weakness. Phishme was able to reverse engineer Bart to create a decrypter, offering a reprieve for users affected by this variant of Bart.
More information on Bart can be found at the Phishme website.
-- Rick Wanner MSISE - rwanner at isc dot sans dot edu - http://ift.tt/16GiVED - Twitter:namedeplume (Protected)
