New RedEye Ransomware Attack Destroy Computers [source: gbhackers]

10 Jun 2018

No Comments

1892

Newly Discovered RedEye Ransomware spreading via Twitter and target the victims to encrypt the data and lock the file to demand the ransom amount in Bitcoin.

Also, RedEye Ransomware is capable of destroying the victim’s computer after the warning time to pay the ransom amount.

This New Ransomware variant created by the same author who is behind the Annabelle ransomware that was actively spreading earlier of this year.

The name RedEye was named by the ransomware author iCoreX” and this ransomware demands the ransom amount in bitcoin through the Bitcoin wallet ID and the transaction should be made by Onion Payment portal.

RedEye Ransomware threatening the victims through Twitter and it asking to check out a “scary & really nasty” sample.

RedEye Ransomware Attack Vector

Once RedEye compromises the user then it drops a file with the size of 30 MB that contains several media files, specifically images and audio files, embedded in the binary.

A dropped file contains 3 “.wav” files: child.wav, redeye.wav, suicide.wav that play a “creepy” sound and the main intention of the sound to scare the user.

RedEye Ransomware author using few other tricks such as compression and packing to evade the detection.

Once it starts the execution process, initially it will disable task manager and in this iteration, will also hide your drives.

Later it will completely encryption all the victim files using Rijndael-Algorithmus – AES – 256 Bit encryption algorithm and lock all the disk files.

After the successful completion of the encryption process, it will display the ransom notes with detailed information about what just could be happened in victims computer.

Ransom notes containing complete information about the payment and it demands to pay 0.1 Bitcoin($765 USD) to the given address.

For more, click here.