The latest, ever-growing trend in the world of cybercrime is cryptojacking, a phenomenon that is a result of people's increasing preoccupation with digital currencies. Before that, however, ransomware like WannaCry was what made life difficult for users.
And now, a new ransomware called RedEye has been discovered by a security researcher who first spotted the malware in February. It claims to destroy a victim's computer if a ransom is not paid within a given deadline. It's worth noting that the new malware is the work of the same creator responsible for the Annabelle ransomware.
The researcher says that the malicious file is very large compared to other ransomware. The huge size of 35MB is due to audio and image files. When it comes to audio, after infecting a device, the ransomware plays three scary sounds to scare the user.
The ransomware is protected using compression and ConfuserEx. It gradually replaces the MBR and performs a number of actions to make its removal difficult: it hides drives, disables the task manager, etc.
After infection, the malware displays a message saying that the AES256 algorithm has encrypted all of the user's personal files. In reality, it overwrites or fills the files with 0 bytes.
As the message claims, the only way for the user to get their files back is to pay 0.1 Bitcoins. “You have 4 days to pay, when this deadline expires, your computer will be completely destroyed,” the message states.
In case a computer is infected by RedEye, the researcher lists what steps you should take to remove it or recover lost files. You can read more details about this here.
