Regretlocker: a New Strain of Ransomware That Targets

This guide provides a clear, practical overview of regretlocker: a new strain of ransomware that targets, with useful context, important details, and straightforward takeaways for everyday readers.

In fact, RegretLocker was first spotted in October, and is judged to be a formally simple ransomware strain because it doesn't contain lengthy ransom notices and specifically only uses email for communications. to the victim, not a regular Tor payment site.

RegretLocker's ransom notes

Once a file is successfully encrypted, RegretLocker adds a harmless sounding .mouse extension to the filename. But in fact, hidden inside it is an extremely unique encryption mechanism.

Regretlocker: a New Strain of Ransomware That Targets

The file after being encrypted by RegretLocker

RegretLocker's dangerous encryption technique

When setting up a Windows Hyper-V virtual machine, a virtual hard disk is also created and stored in a VHD or VHDX file.

These virtual hard disk files contain raw disk images, include the partition table of the virtual drive and the partitions that are similar to regular drives, and can range in size from several GB to TB rows.

When ransomware encrypts data on your computer, encrypting a large file is ineffective because it slows down the speed of the entire process. In a ransomware sample discovered by MalwareHunterTeam and analyzed by Advanced Intel security engineer Vitali Kremez, RegretLocker used a relatively unique encryption technique, which is to mount virtual disk files for individual encryption.

ingredients quickly and easily. To implement this technique, RegretLocker uses the Windows Virtual Storage APIs OpenVirtualDisk, AttachVirtualDisk, and GetVirtualDiskPhysicalPath for the purpose of mounting the virtual disk.

RegretLocker's dangerous encryption technique — Regretlocker: a New Strain of Ransomware That Targets

The malware mounts a VHD file

After the virtual drive has been mounted as a physical disk in Windows, ransomware can completely encrypt each individual drive, thereby significantly increasing encryption speed.

In addition to using the Virtual Storage API, RegretLocker was found to abuse the Windows Restart Manager API to terminate Windows processes or services that left files open during encryption.

When using this API, if the name of the process contains 'vnc', 'ssh', 'mstsc', 'System' or 'svchost.exe' then ransomware will not terminate that process. This exception list can be used to prevent important programs or programs used by hackers to access the target system from being accidentally stopped. The Windows Restart Manager API is currently only used by some popular ransomware such as REvil (Sodinokibi), Ryuk, Conti, ThunderX / Ako, Medusa Locker, SamSam, and LockerGoga.

RegretLocker's dangerous encryption technique — Regretlocker: a New Strain of Ransomware That Targets

Windows Restart Manager Exceptions List

RegretLocker is not very active yet and is really popular right now, but this is clearly a dangerous ransomware strain that needs to be kept an eye out for now.

Key Takeaways

Use the information above as a practical reference for regretlocker: a new strain of ransomware that targets. Review each step carefully, confirm any requirements, and choose the option that best fits your situation.

FAQ

What does this guide explain about Regretlocker: a New Strain of Ransomware That Targets?

It explains the main concepts, practical considerations, and useful steps related to regretlocker: a new strain of ransomware that targets without requiring advanced knowledge.

Who can benefit from learning about Regretlocker: a New Strain of Ransomware That Targets?

This information is useful for readers who want a clear overview, practical guidance, and reliable steps related to regretlocker: a new strain of ransomware that targets.

What should I check before applying this information?

Review the requirements, confirm that your device, software, or situation matches the instructions, and back up important data before making major changes.