{"id":12135,"date":"2016-05-18T09:00:04","date_gmt":"2016-05-18T13:00:04","guid":{"rendered":"https:\/\/www.kaspersky.com\/blog\/?p=12135"},"modified":"2020-02-26T11:09:24","modified_gmt":"2020-02-26T16:09:24","slug":"mischa-ransomware","status":"publish","type":"post","link":"https:\/\/www.kaspersky.com\/blog\/mischa-ransomware\/12135\/","title":{"rendered":"Mischa: a friend for Petya and yet more ransomware for the rest of the world"},"content":{"rendered":"<p><b>[Updated on June 28, 2017]<\/b><\/p>\n<p>Petya and Mischa are friends. They usually do everything together\u2026.<\/p>\n<p>Oh, wait, this is not some \u201cRussian for Dummies\u201d book, it\u2019s the Kaspersky Daily blog. So, Petya and Mischa are both ransomware, and they are delivered to the user together, in one package.<\/p>\n<p><a href=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/92\/2016\/05\/06022221\/mischa-ransomware-fb.png\"><img decoding=\"async\" src=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/92\/2016\/05\/06022221\/mischa-ransomware-fb.png\" alt=\"Mischa ransomware: Petya's accomplice\" width=\"1280\" height=\"1280\" class=\"aligncenter size-full wp-image-12137\"><\/a><\/p>\n<p>If you are a regular visitor to this blog, or if you keep track of cybersecurity news, you probably know what Petya is. We dedicated two separate posts to it, because in couple of weeks after <a href=\"https:\/\/www.kaspersky.com\/blog\/petya-ransomware\/11715\/\" target=\"_blank\" rel=\"noopener nofollow\">Petya emerged<\/a> Twitter user <a href=\"https:\/\/twitter.com\/leo_and_stone\" target=\"_blank\" rel=\"noopener nofollow\">@leo_and_stone<\/a> came up with a <a href=\"https:\/\/www.kaspersky.com\/blog\/petya-decryptor\/11819\/\" target=\"_blank\" rel=\"noopener nofollow\">decryptor for Petya<\/a>.<\/p>\n<p>Petya stood out from the ransomware crowd because it didn\u2019t just encrypt certain types of files, but rather made the whole hard drive of a computer unreadable by encrypting its <a href=\"https:\/\/en.wikipedia.org\/wiki\/NTFS#Internals\" target=\"_blank\" rel=\"noopener nofollow\">Master File Table<\/a>. For this reason, any user who fell victim to Petya needed another PC just to pay the ransom. Well, after leo_and_stone created his encryption tool, Petya victims still needed another PC, but it was to decrypt their files <i>without<\/i> paying the ransom.<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\"><a href=\"https:\/\/twitter.com\/hashtag\/Petya?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#Petya<\/a> <a href=\"https:\/\/twitter.com\/hashtag\/ransomware?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#ransomware<\/a> eats your hard drives \u2013 <a href=\"https:\/\/t.co\/BSqbmRBmGf\" target=\"_blank\" rel=\"noopener nofollow\">https:\/\/t.co\/BSqbmRBmGf<\/a> <a href=\"https:\/\/t.co\/WpvijrPlSP\" target=\"_blank\" rel=\"noopener nofollow\">pic.twitter.com\/WpvijrPlSP<\/a><\/p>\n<p>\u2014 Kaspersky (@kaspersky) <a href=\"https:\/\/twitter.com\/kaspersky\/status\/715232633316384772?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">March 30, 2016<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<h3>Meet Mischa<\/h3>\n<p>Petya had a weakness. To start doing its dirty job, Petya required root access privileges. Unless a user agrees to grant those privileges by pressing \u2018Yes\u2019 button, Petya could not harm the user\u2019s computer. So Petya\u2019s creators remedied their slip-up by bundling Petya with another piece of ransomware \u2014 one with another Russian-sounding name, Mischa.<\/p>\n<p>There are two main differences between Petya and Mischa. Petya deprives you of the whole hard drive, whereas Mischa encrypts only certain file types, and that is probably the good news. The bad news is that unlike Petya, Mischa doesn\u2019t require administrator access privileges. Looks like their creators think that Petya and Mischa complement each other very well.<\/p>\n<p>Mischa looks more like a common piece of ransomware of the sort that pops up every now and then. It uses AES encryption to encrypt data files on your computer. As the Bleeping Computer blog <a href=\"http:\/\/www.bleepingcomputer.com\/news\/security\/petya-is-back-and-with-a-friend-named-mischa-ransomware\/\" target=\"_blank\" rel=\"noopener nofollow\">notes<\/a>, it adds a four-character extension to the encrypted files so that, for example, test.txt becomes test.txt.7GP3.<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\"><a href=\"https:\/\/twitter.com\/hashtag\/Petya?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#Petya<\/a> <a href=\"https:\/\/twitter.com\/hashtag\/ransomware?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#ransomware<\/a> installs <a href=\"https:\/\/twitter.com\/hashtag\/Mischa?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#Mischa<\/a> as failsafe via <a href=\"https:\/\/twitter.com\/threatpost?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">@threatpost<\/a> <a href=\"https:\/\/t.co\/qtRhTNKzen\" target=\"_blank\" rel=\"noopener nofollow\">https:\/\/t.co\/qtRhTNKzen<\/a> <a href=\"https:\/\/t.co\/eRDVoNqEl3\" target=\"_blank\" rel=\"noopener nofollow\">pic.twitter.com\/eRDVoNqEl3<\/a><\/p>\n<p>\u2014 Kaspersky (@kaspersky) <a href=\"https:\/\/twitter.com\/kaspersky\/status\/731201838838583297?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">May 13, 2016<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>The list of file types that Mischa prefers for its grim dinner is rather huge; it even includes .exe files, meaning that Mischa prevents users from running almost any programs. However, while encrypting, Mischa skips the Windows folder and the folders of installed browsers. After its dirty job is done, Mischa creates two files with payment instructions for the user: YOUR_FILES_ARE_ENCRYPTED.HTML and YOUR_FILES_ARE_ENCRYPTED.TXT.<\/p>\n<p>Petya and Mischa are distributed via phishing letters pretending to be job applications. When Mischa malware was discovered, it came in a file called PDFBewerbungsmappe.exe (German for \u201cPDF job application documents\u201d). The use of German language in the file name and the way this ransomware is distributed indicates its main target: German-speaking enterprises.<\/p>\n<blockquote class=\"twitter-pullquote\"><p>#Petya #ransomware now comes with accomplice #Mischa<\/p><a href=\"https:\/\/twitter.com\/share?url=https%3A%2F%2Fkas.pr%2Fe4z1&amp;text=%23Petya+%23ransomware+now+comes+with+accomplice+%23Mischa\" class=\"btn btn-twhite\" data-lang=\"en\" data-count=\"0\" target=\"_blank\" rel=\"noopener nofollow\">Tweet<\/a><\/blockquote>\n<p>When a user attempts to open the .exe file that contains both Mischa and Petya, a User Account Control window pops up, asking if the user is willing to grant administrative access privileges to the program. This is one of those unpleasant moments when <i>both<\/i> choices are bad. If the user chooses \u201cYes,\u201d Petya is installed. Selecting \u201cNo\u201d installs Mischa.<\/p>\n<p>Mischa seems to be even greedier then Petya: It demands about 1.93 bitcoins as ransom, which is approximately $875. Petya asked for 0.9 bitcoins.<\/p>\n<p>Fun fact (if there can be anything fun about ransomware at all): Petya is a Russian name, and Mischa may also look like one, but actually, it isn\u2019t. A Russian-speaking person would use Misha, without the \u201cc\u201d in the middle \u2014 it sounds quite weird with the \u201cc\u201d!<\/p>\n<p>Unfortunately, no decryption tools are available for Mischa yet. There is one <a href=\"https:\/\/www.kaspersky.com\/blog\/petya-decryptor\/11819\/\" target=\"_blank\" rel=\"noopener nofollow\">for Petya<\/a>, but running it requires spare PC and some skills.<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\"><a href=\"https:\/\/twitter.com\/hashtag\/Ransomware?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#Ransomware<\/a> bug leads to <a href=\"https:\/\/twitter.com\/hashtag\/Petya?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#Petya<\/a> decryptor  <a href=\"https:\/\/t.co\/37fMAxbsRd\" target=\"_blank\" rel=\"noopener nofollow\">https:\/\/t.co\/37fMAxbsRd<\/a> <a href=\"https:\/\/t.co\/8M84rY3jXG\" target=\"_blank\" rel=\"noopener nofollow\">pic.twitter.com\/8M84rY3jXG<\/a><\/p>\n<p>\u2014 Kaspersky (@kaspersky) <a href=\"https:\/\/twitter.com\/kaspersky\/status\/719579558991831040?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">April 11, 2016<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>So, to avoid falling victim to Petya or Mis\u0441ha, or whatever Vasya, SuperCrypt, El Rapto, etc. comes next, we recommend you do the following:<\/p>\n<p>1 <b>Make backups.<\/b> Do it frequently and diligently. If you have current backups of your files, you can tell this ransomware to \u2026 well, whatever you want it to do.<\/p>\n<p>2. <b>Trust no one and be educated.<\/b> A job application has an .exe extension? Hmm, looks suspicious \u2014 don\u2019t open it. Better safe than sorry!<\/p>\n<p>3. <b>Install a good security solution.<\/b> <a href=\"https:\/\/www.kaspersky.com\/advert\/multi-device-security?redef=1&amp;THRU&amp;reseller=gl_KDpost_pro_ona_smm__onl_b2c_kasperskydaily_lnk____kismd___&amp;_ga=1.193052847.300785052.1449065439\" target=\"_blank\" rel=\"noopener nofollow\">Kaspersky Internet Security<\/a> has multiple levels of protection, and it won\u2019t let Mischa or other ransomware through.<\/p>\n<p>Kaspersky Internet Security has an anti-spam component that protects you from spam and phishing mails. It has anti-virus that detects Mischa and Petya, aka Trojan-Ransom.Win32.Mikhail and Trojan-Ransom.Win32.Petr, and gets rid of them. It also has a System Watcher feature, which detects unusual activity (for example, attempts to encrypt multiple files) and blocks it. <a href=\"https:\/\/www.kaspersky.com\/advert\/total-security-multi-device?redef=1&amp;THRU&amp;reseller=gl_KDpost_pro_ona_smm__onl_b2c_kasperskydaily_lnk____ktsmd___&amp;_ga=1.193052847.300785052.1449065439\" target=\"_blank\" rel=\"noopener nofollow\">Kaspersky Total Security<\/a> has all of the aforementioned features, plus a tool for creating automated backups.<\/p>\n<input type=\"hidden\" class=\"category_for_banner\" value=\"kis-trial-ransomware\">\n<h3>Update from June 28, 2017<\/h3>\n<p>If you\u2019re looking for information regarding the new Petya \/ NotPetya \/ ExPetr ransomware outbreak, we have a <a href=\"https:\/\/www.kaspersky.com\/blog\/new-ransomware-epidemics\/17314\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">dedicated post with advice on how to protect your files<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The Petya ransomware installer now includes another ransomware called Mischa that complements it.<\/p>\n","protected":false},"author":696,"featured_media":12138,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[5,2683],"tags":[1620,1621,1511,420,422,723],"class_list":{"0":"post-12135","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-news","8":"category-threats","9":"tag-mischa","10":"tag-misha","11":"tag-petya","12":"tag-ransomware","13":"tag-threats","14":"tag-trojans"},"hreflang":[{"hreflang":"x-default","url":"https:\/\/www.kaspersky.com\/blog\/mischa-ransomware\/12135\/"},{"hreflang":"en-gb","url":"https:\/\/www.kaspersky.co.uk\/blog\/mischa-ransomware\/7202\/"},{"hreflang":"es-mx","url":"https:\/\/latam.kaspersky.com\/blog\/mischa-ransomware\/7142\/"},{"hreflang":"es","url":"https:\/\/www.kaspersky.es\/blog\/mischa-ransomware\/8345\/"},{"hreflang":"it","url":"https:\/\/www.kaspersky.it\/blog\/mischa-ransomware\/8201\/"},{"hreflang":"ru","url":"https:\/\/www.kaspersky.ru\/blog\/mischa-ransomware\/11953\/"},{"hreflang":"fr","url":"https:\/\/www.kaspersky.fr\/blog\/mischa-ransomware\/5668\/"},{"hreflang":"de","url":"https:\/\/www.kaspersky.de\/blog\/mischa-ransomware\/7703\/"},{"hreflang":"ja","url":"https:\/\/blog.kaspersky.co.jp\/mischa-ransomware\/11431\/"},{"hreflang":"ru-kz","url":"https:\/\/blog.kaspersky.kz\/mischa-ransomware\/11953\/"},{"hreflang":"en-au","url":"https:\/\/www.kaspersky.com.au\/blog\/mischa-ransomware\/12135\/"},{"hreflang":"en-za","url":"https:\/\/www.kaspersky.co.za\/blog\/mischa-ransomware\/12135\/"}],"acf":[],"banners":"","maintag":{"url":"https:\/\/www.kaspersky.com\/blog\/tag\/ransomware\/","name":"Ransomware"},"_links":{"self":[{"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/12135","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/users\/696"}],"replies":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/comments?post=12135"}],"version-history":[{"count":5,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/12135\/revisions"}],"predecessor-version":[{"id":33694,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/12135\/revisions\/33694"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/media\/12138"}],"wp:attachment":[{"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/media?parent=12135"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/categories?post=12135"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/tags?post=12135"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}