Erebus Ransomware

## Erebus Ransomware Overview

The Erebus ransomware is a new malware of unknown origin. At the moment the security experts cannot conclude if this is a new virus or is an offspring from a previously known malware family.

It features the a typical encryption engine that has uses the AES cipher to target various user data and extort the victims for a ransomware fee. Each infected host receives an unique hash ID which is appended to the compromised files using the following pattern – {hash}.ecrypt. The virus sdeletes all Shadow Volume Copies of the infected computer.

## Erebus Ransomware Affected File Types

> .1cd, .3dm, .3ds, .3fr, .3g2, .3gp, .3pr, .7z, .7zip, .aac, .ab4, .abd, .accdb, .accde, .accdr, .accdt, .ach, .acr, .act, .adb, .adp, .ads, .agdl, .ai,
>
>

> .aiff, .ait, .al, .aoi, .apj, .arw, .ascx, .asf, .asm, .asp, .aspx, .asx, .atb, .avi, .awg, .back, .backup, .backupdb, .bak, .bank, .bay, .bdb, .bgt, .bik,
>
>

> .bin, .bkp, .blend, .bmp, .bpw, .c, .cdb, .cdf, .cdr, .cdr3, .cdr4, .cdr5, .cdr6, .cdrw, .cdx, .ce1, .ce2, .cer, .cfg, .cfn, .cgm, .cib, .class, .cls, .cmt,
>
>

> .config, .contact, .cpi, .cpp, .cr2, .craw, .crt, .crw, .cs, .csh, .csl, .css, .csv, .dac, .dat, .db, .db\_journal, .db3, .dbf, .dbx, .dc2, .dcr, .dcs, .ddd,
>
>

> .ddoc, .ddrw, .dds, .def, .der, .des, .design, .dgc, .dit, .djvu, .dng, .doc, .docm, .docx, .dot, .dotm, .dotx, .drf, .drw, .dtd, .dwg, .dxb, .dxf, .dxg,
>
>

> .edb, .eml, .eps, .erbsql, .erf, .exf, .fdb, .ffd, .fff, .fh, .fhd, .fla, .flac, .flb, .flf, .flv, .flvv, .fpx, .fxg, .gif, .gray, .grey, .groups, .gry,
>
>

> .h, .hbk, .hdd, .hpp, .html, .ibank, .ibd, .ibz, .idx, .iif, .iiq, .incpas, .indd, .info, .info\_, .ini, .jar, .java, .jnt, .jpe, .jpeg, .jpg, .js, .json,
>
>

> .kc2, .kdbx, .kdc, .key, .kpdx, .kwm, .laccdb, .lck, .ldf, .lit, .lock, .log, .lua, .m, .m2ts, .m3u, .m4p, .m4v, .mab, .mapimail, .max, .mbx, .md, .mdb,
>
>

> .mdc, .mdf, .mef, .mfw, .mid, .mkv, .mlb, .mmw, .mny, .moneywell, .mos, .mov, .mp3, .mp4, .mpeg, .mpg, .mrw, .msf, .msg, .myd, .nd, .ndd, .ndf, .nef,
>
>

> .nk2, .nop, .nrw, .ns2, .ns3, .ns4, .nsd, .nsf, .nsg, .nsh, .nvram, .nwb, .nx2, .nxl, .nyf, .oab, .obj, .odb, .odc, .odf, .odg, .odm, .odp, .ods, .odt,
>
>

> .ogg, .oil, .omg, .orf, .ost, .otg, .oth, .otp, .ots, .ott, .p12, .p7b, .p7c, .pab, .pages, .pas, .pat, .pbf, .pcd, .pct, .pdb, .pdd, .pdf, .pef, .pem,
>
>

> .pfx, .php, .pif, .pl, .plc, .plus\_muhd, .pm, .pm!, .pmi, .pmj, .pml, .pmm, .pmo, .pmr, .pnc, .pnd, .png, .pnx, .pot, .potm, .potx, .ppam, .pps, .ppsm,
>
>

> .ppsm, .ppsx, .ppt, .pptm, .pptm, .pptx, .prf, .ps, .psafe3, .psd, .pspimage, .pst, .ptx, .pwm, .py, .qba, .qbb, .qbm, .qbr, .qbw, .qbx, .qby, .qcow,
>
>

> .qcow2, .qed, .qtb, .r3d, .raf, .rar, .rat, .raw, .rdb, .rm, .rtf, .rvt, .rw2, .rwl, .rwz, .s3db, .safe, .sas7bdat, .sav, .save, .say, .sd0, .sda, .sdb,
>
>

> .sdf, .sh, .sldm, .sldx, .sql, .sqlite, .sqlite3, .sqlitedb, .sqlite-shm, .sqlite-wal, .sr2, .srb, .srf, .srs, .srt, .srw, .st4, .st5, .st6, .st7, .st8,
>
>

> .stc, .std, .sti, .stm, .stw, .stx, .svg, .swf, .sxc, .sxd, .sxg, .sxi, .sxm, .sxw, .tbb, .tbn, .tex, .tga, .thm, .tif, .tlg, .tlx, .txt, .usr, .vbox, .vdi,
>
>

> .vhd, .vhdx, .vmdk, .vmsd, .vmx, .vmxf, .vob, .wab, .wad, .wallet, .war, .wav, .wb2, .wma, .wmf, .wmv, .wpd, .wps, .x11, .x3f, .xis, .xla, .xlam, .xlk, .xlm,
>
>

> .xlr, .xls, .xlsb, .xlsm, .xlsx, .xlt, .xltm, .xltx, .xlw, .xml, .ycbcra, .yuv, .zip
>
>

The malicious engine skips the following folders and files :

> C:\$recycle.bin
>
>

> C:\$windows.~bt
>
>

> C:\boot
>
>

> C:\drivers
>
>

> %Program Files%
>
>

> %Program Data%
>
>

> %User Profile%
>
>

> %Windows%
>
>

> C:\windows.old
>
>

> %AppDataLocal%
>
>

> %AppDataLocalLow%
>
>

> %Application Data%\adobe\flash player
>
>

> %Application Data%\ati
>
>

> %Application Data%\google
>
>

> %Application Data%\identities
>
>

> %Application Data%\installshield
>
>

> %Application Data%\intel
>
>

> %Application Data%\macromedia\flash player
>
>

> %Application Data%\media center programs
>
>

> %Application Data%\microsoft
>
>

> %Application Data%\mozilla
>
>

> %Application Data%\nvidia
>
>

> %Application Data%\opera
>
>

> \public\music\sample music
>
>

> \public\pictures\sample pictures
>
>

> \public\videos\sample videos
>
>

> \tor browser
>
>

> bootsect.bak
>
>

> desktop.ini
>
>

> iconcache.db
>
>

> ntuser.dat
>
>

> thumbs.db
>
>

> wallet.dat
>
>

## Erebus Ransomware Note

> Warning!
>
>

> Your documents, photos, databases, important files been encrypted!
>
>

> What happened to your files?
>
>

> All of your files were protected by a strong encryption whit RSA-2048.
>
>

> More information about the encryption keys using RSA-2048 can be found here. xxxxs://en.wikipedia.org/wiki/RSA\_(encryption)
>
>

> What does this mean?
>
>

> This means that the structure and data within your files have been irrevocably changed. You will not be able to work with them, read them or see them.
>
>

> It is the same thing as losing them forever. But with our help, you can restore them.
>
>

> How did this happen?
>
>

> Especially for you. On our server was generated the secret key pair RSA-2048 public and private.
>
>

> All your files were encrypted with the public key. Which has been transferred to your computer via the Internet.
>
>

> Decrypting of your files is only possible with the help of the private key and decrypt program. Which is on our secret server.
>
>

> What do I do?
>
>

> If you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed. If you really value your data.
>
>

> Then we suggest you do not waste valuable time searching for other solutions because they do not exist.
>
>

> Remember that your machine ID:
>
>

> For more specific instructions please visit your personal home page. There are a few different addresses pointing to your page below:
>
>

> xxxx://wsb5cxo671abtrsg.j57xi.top/
>
>

> xxxx://nicc3j2o5rtsllvw.j57xi.top/
>
>

> If the above address will be unable to open or very slow, follow these steps:
>
>

> 1. Download and install the tor browser.
>
>

> 2. After successful installation, run the browser, waiting to initialize.
>
>

> 3. In the address bar enter:
>
>

> xxxx://wsb5cxo671abtrsg.j57xi.top/
>
>

> xxxx://nicc3j2o5rtsllvw.j57xi.top/
>
>

## Erebus Ransomware Distribution

In many of the analyzed attack campaigns the virus affectes mainly English-speaking users. The infection methods are spam email messages and infected software bundles.

## Erebus Ransomware Removal

In-depth removal instructions and detailed technical information about the virus can be found on Best Security Search.