November 20, 2015

Emergence of new encryption ransomware for Linux that was dubbed Linux.Encoder.1 got a huge response from ordinary users and IT specialists worldwide—as it turned out, even such secure system as Linux can become a target of ransomware Trojans. Moreover, recently, at least two other representatives of this family came into light. Doctor Web security researchers have carefully examined one of them and dubbed it Linux.Encoder.2.

Despite the fact that this Trojan was added to Dr.Web virus databases under the second number, it had been created earlier, but, nonetheless, never fell under the scrutiny of security researchers. Moreover, not long ago one anti-virus company reported on examination results of another Trojan that was dubbed Linux.Encoder.0—this Trojans is assumed to be the a pioneer of this group, while distribution of Linux.Encoder.2 was carried out from September till October 2015. Later, there appeared Linux.Encoder.1.

Unlike Linux.Encoder.1, this modification employs another pseudorandom number generator and encrypts files using the OpenSSL library (not PolarSSL, like Linux.Encoder.1). Moreover, encryption is performed in the AES-OFB-128 mode with context reinitialization every 128 bytes, that is every 8 AES blocks. Also in Linux.Encoder.2 there are a number of other significant changes from the alternative execution of this encoder.

It should be noted that all the known file decryption utilities do not delete the shell script from the infected server—thus, cybercriminals can use it later to reinfect the system. That is why Doctor Web technical support specialists help all users who sent a request ticket remove additional malicious programs from their systems and protect their machines from future possible attacks carried out using this script.

The signature of Linux.Encoder.2 was added to Dr.Web virus databases for Linux. Doctor Web security researchers have developed a new technique that, in most cases, can help decrypt files compromised by the malware. If you have fallen victim to Linux.Encoder.2, follow the guidance below:

• Notify the police.
• Do not, under any circumstances, attempt to change the contents of directories with encrypted files.
• Do not delete any files from the server.
• Do not try to restore the encrypted data by yourself.
• Contact Doctor Web technical support (free decryption service is only available to users who have purchased commercial licenses for Dr.Web products).
• Attach a file encrypted by the Trojan to the request ticket.
• Wait for a response from technical support. Due to a large number of requests, it may take some time.

Once again we would like to point out that free decryption service is only available to users who have purchased commercial licenses for Dr.Web products. Doctor Web cannot guarantee that all your files will be decrypted successfully. However, our specialists will do their best to recover the encrypted data.

More about this Trojan