COBRA CRYSIS - NEW VARIANT OF RANSOMWARE
New variant of the Crysis / Dharma ransomware that adds the .cobra extension to the encrypted files
Recently, security researcher Jakub Kroustek discovered a new ransomware sample that appears to be a new variant of the ransomware Crysis that appends the .cobra extension to the file name of the encrypted file.It is not known exactly how this variant is distributed, but in the past Crysis is normally propagated by piracy in remote desktop services and manually installs the ransomware.
When this variant of Cobra ransomware is installed, a computer will be scanned for data files and encryption of them. When you encrypt a file, an extension will be added in the
.id- [id]. [E-mail] .cobra format .id- [id]. [E-mail] .cobra .id- [id]. [E-mail] .cobra . For example, a file called pepe.jpg was encrypted and the name was changed to pepe.jpg.id-BCBEF350.[Cranbery@colorendgrace.com].cobra .
It should be noted that this ransomware will encrypt assigned network drives and unassigned network shares. Therefore, it is important to make sure that the actions of your network are blocked so that only those who really need access have permission.
When this variant encodes a computer, it will also remove all plumes from volume snapshots on the machine so that they can not be used to recover encrypted files. It is removed by running the
vssadmin delete shadows /all /quiet .This ransomware will also create two different rescue notes on the infected machine. One of them is the file
info.hta , which was launched by an automatic execution when a user initiates a session on the computer.
The other note is called encrypted files !!. Txt and can be found on the desktop.
Both rescue notes contain instructions to contact
cranbery@colorendgrace.com in order to obtain payment instructions.Finally, the ransomware will be configured to start automatically when it connects to Windows. This allows you to encrypt new files that are created since the last time executed.
It is not possible to decipher the new variant of Crysis Cobra
Unfortunately, at this time it is not possible to decrypt the files encrypted by the .cobra Crysis ransomware for free. The only way to recover the encrypted files is through a backup, or if you are unbelievably lucky, through volume snapshots. Although Crysis does not attempt to remove volume snapshots, in rare cases, ransomware infections do not do so for any reason.How to protect yourself from the Crysis ransomware
In order to protect yourself from Crysis, or from any ransomware, it is important that you use good computer habits and security software. First and foremost, you should always have a reliable and proven backup of data that can be restored in the event of an emergency, such as an attack on the ransomware. You must also have security software that contains behavioral detections such as squared Anti-Malware, Malwarebytes, or HitmanProIOC :
COBRA SHA256: de6376e23536b3039afe6b0645da4fc180969b1dc3cc038b1c6bd5941d88c4d8 Cobra Associated Emails:
cranbery@colorendgrace.com https://www.hybrid-analysis.com/sample/45fb6d93d7bbfdde3d56ddad3861d85e94551c86bd1409c709ad5895d5f7e4ae?environmentId=100
https://virustotal.com/ru/file/de6376e23536b3039afe6b0645da4fc180969b1dc3cc038b1c6bd5941d88c4d8/analysis/
