1

Why does a perfc file in the Windows directory prevent the recent Petya ransomware? Is it a bug in the ransomware that halt's it from executing? Or is it a deliberate attempt of the creators to allow people to find a cure to prevent it? Or as the media stated "to use the killswitch".

In the case of a cure, if the ransomware was created to make as much damage as possible. Then, why would they make such a decision/mistake?

Additionally, does it regard the creation of a "perfc" file without file extension or a "perfc.dll" file?

Improve this question

2 Answers 2

Reset to default
3

It doesn't stop the infection as such, what it seems to do if Petya detects (as it looks like it searches for it) perfc.dat is stop it from running the file scrambling portion of the code on your machine. So while you still have access to your machine and all your data you are still infected.

So what does Petya do if perf.dat is detected, if not the file scrambling? What it does is use your computer as a foothold into a network to continue spreading internally (not externally, unlike WannaCry).

From what I found while researching this answer, the only thing the perfc.dat 'vaccine' stops is the file scrambling, I believe (In that I couldn't find any source that said otherwise) that it still attempts to lift credentials from RAM to allow it to gain admin access, and travel further through a network.

As to whether its a bug or a feature, the f-secure link I've posted at the bottom has a nice analysis suggesting that the malware, which has a very sophisticated network propagation component, and less sophisticated MBR and user mode component (this does the encryption/decryption of files, and apparenytly does work properly), suffered a suddenly reduced deadline after WannaCry flung EternalBlue to headline news, reducing the attackers' potential options for spreading around a network.

I'm not sure if we can be sure, but I'd put it down to the 'vaccine' being a bug, rather than an intended feature. F-secure did some very nice write ups about Petya on their 'From the Labs' blog, most of which can be found from the one I linked below, I'd link a few more but I don't have the reputation.

Sources:

https://www.theregister.co.uk/2017/06/28/petya_notpetya_ransomware/

https://labsblog.f-secure.com/2017/06/30/eternal-petya-from-a-developers-perspective/

Improve this answer
1

Chapter 29 of the recent book Sandworm suggests the virus's authors may have put the perfc on 10% of a target company PCs prior to unleashing NotPetya, so they would be able to wander around the target's network after the target cleaned up the mess.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .