Malware News Ransomware or Wiper? RedBoot Encrypts Files but also Modifies Partition Table

[Solarquest]

A new bootlocker ransomware was discovered by Malware Blocker called RedBoot that when executed will encrypt files on the computer, replace the MBR, or Master Boot Record, of the system drive and then then modifies the partition table in some manner.

As the ransomware does not provide a way to input a key to restore the MBR and partition table, unless the ransomware developer has a bootable decryptor this malware may be a wiper.

The RedBoot Encryption Process
When the RedBoot ransomware, which is a compiled AutoIT executable, is executed it will extract 5 other files into a random folder in the directory that the launcher was executed. These files are boot.asm, assembler.exe, main.exe, overwrite.exe, and protect.exe and are described below.

....

 

[Solarquest]

Good news.
For the installer

VT 38/64
VirusTotal

But
VirusTotal

VirusTotal

 

[tonibalas]

Eset is 2/3 on this one.
MBR protection.One thing comes in mind for protecting and i have it installed. Shadow Defender

 

[Deleted member 65228]

For anyone interested:

Image source: the Bleeping Computer article.

BITS 16
ORG 0x7c00

The above is needed because the ASM code is 16-bit (first line) and because the BIOS loads the first boot sector at address 0x7c00 in memory.

times 510 - ($-$$) db 0
dw 0xaa55

The above is there to ensure the custom boot sector is the correct size (second to last line), and to provide the boot signature (last line) so the BIOS knows it is bootable.

If anyone is using MBR Filter, you will be protected from attacks like this also (and also Volume Boot Record attacks since MBR Filter supports that too).