HomeWinBuzzer NewsNew 'RedBoot' Ransomware May Leave Data Unrecoverable

New ‘RedBoot’ Ransomware May Leave Data Unrecoverable

RedBoot modifies the boot partition and provides no way for a user to input a reversal key, signaling a destructive wiper. The Developer asks users to contact [email protected] for removal.

-

A bootlocker ransomware named ‘RedBoot' was recently discovered by Malware Blocker, but new evidence suggests it's not ransomware at all.

According to BleepingComputer's Lawrence Abrams, RedBoot encrypts user's files, replaces the Master Boot Record, and then modifies the partition table. As the developer doesn't provide a way to input a key, a bootable decryptor for each PC would be the only way to restore files.

This happens despite its ransom screen, which asks victims to email the creator with their ID key for unlocking and payment instructions.

“This computer and all of it's files have been locked! Send an email to [email protected] containing your ID or instructions on how to unlock them. Your ID key is ____,” reads the message.

Bad Coding or Intentional?

At this point, it's unclear if RedBoot is simply buggy, or if the creator is intentionally misleading users. The email address seems to suggest the latter. There's been a rise of so-called Memeware in recent times – malware that doesn't just extort users but tricks them.

A recent release called NRansom, for example, asks the user for nude photos before it will unlock their PC. Another version asks users to kill ten people and send proof. Though disguised as ransomware, it's actually a blocker, and can be remedied with simple steps.

A recent release called NRansom, for example, asks the user for nude photos before it will unlock their PC. Another version asks users to kill ten people and send proof. Though disguised as ransomware, it's actually a blocker, and can be remedied with simple steps.

Unfortunately, the same can't be said for RedBoot. A file called protect.exe stops users from opening and ProcessHacker, while the MBR re-write stops users booting Windows, and .dll breaks many services.

It seems, then, that the only way out for users is a system restore, and all data will be lost as a result. The analysis is still in the early stages, however, so it's possible more information will arise.

Ryan Maskell
Ryan Maskellhttps://ryanmaskell.co.uk
Ryan has had a passion for gaming and technology since early childhood. Fusing the skills from his Creative Writing and Publishing degree with profound technical knowledge, he enjoys covering news about Microsoft. As an avid writer, he is also working on his debut novel.

Recent News