Greenpetya

**Greenpetya** is a petya variation that encrypts MBR or GPT with XOR 0x07 and MFT with glitchy salsa20 in Greenpetya v1, and full salsa20 in Greenpetya v2, however this only happens if you click Yes on User Account Control prompt.

## Encrypting MBR

Greenpetya ransomware requires first partition to start at at least sector 60 of the disk. It does XOR 0x07 on boot sector (sector 0) and stores it in sector 56. The remaining MBR sectors (1—33) are XOR 0x07 as well. The greenpetya bootloader loads greenpetya kernel from sectors 34—51. Sector 54 stores the information on greenpetya state in the first byte (infected/encrypted/decrypted for 0/1/2), in Greenpetya v1 it stores the salsa20 key in bytes 1—16 in plaintext, in Greenpetya v2 it spongent hashes the salsa20 and stores it in bytes 1—32, and stores personal decryption key as well. Sector 55 initially consists of all 0x07 bytes, about to be encrypted with salsa20.

## Generating personal decryption key

Greenpetya uses CryptGenRandom to generate salsa20 key. The Janus secp192k1 public key is embedded in greenpetya, whereas Janus private key is in janus servers. A key pair of victim private key and victim public key is generated as well. Then it creates a shared secret by using the Janus public key and victim private key, then the shared secret is then expanded with custom algorithim and hashed with SHA512. The salsa20 key is AES 256 ECB encrypted with first 32 bytes of SHA512 hash. victim public key is then encoded with base58 and placed at beginning of the personal decryption code, then encrypted salsa20 key is also encoded with base58 and put after encoded victim public key, and last 2 bytes of the personal decryption code represent the operating system and antivirus the victim uses.

## Encrypting MFT

The salsa20 key is erased from sector 54 at this point, and first byte of sector 54 is set to 1 to mark that the MFT has been encrypted. Greenpetya iterates over NTFS partitions, and finds MFTs in each of them. Each MFT is encrypted with salsa20, and the amount of encrypted MFT clusters is stored in sector 57. After all MFTs have been encrypted, greenpetya uses INT 19h to perform a software reboot to get to the greenpetya skull.

## Entering key and how Janus gets salsa20 key back

User gives personal decryption code to Janus and buys greenpetya decryption, which makes Janus more money. Janus then takes bytes 3-88 of personal decryption code and decodes it with base58 to reveal victim public key and encrypted salsa20 key, Janus then derives the same shared secret with victim public key and Janus private key using ECDH algorithm, then it was expanded with custom algorithm and then hashed with SHA512. AES 256 ECB decrypts the encrypted salsa20 key with first 32 bytes of SHA512 hash and then Janus can give salsa20 key to victim. Greenpetya expects sector 55 to have all 0x07 bytes upon salsa20 decryption. If the bytes there are not all 0x07 bytes, the key is considered to be incorrect.

## Decrypting MFT

After the correct key has been entered, greenpetya decrypts as many MFT clusters as it had encrypted by sector 57 count. The first byte of sector 54 is set to 2, marking the MFT as decrypted. The sectors 1—33 are then XOR 0x07, then sector 56 is XOR 0x07 and written back to sector 0. This restores the MBR back to its original state and lets the system boot.

## Mischa

If you pressed No on User Account Control prompt, it would then activate Mischa instead of Greenpetya. Mischa encrypts files, unlike Greenpetya which encrypts MFT.