#Kaspersky embedded alliance partners code#

Using the Windows API DeviceIoControl, the malware is able to obtain direct read and write access to the physical hard drive, without interaction with the operating system (provided it has the proper administrative permissions). NotPetya overwrites sectors of the physical hard drive and C: volume, but does not contain the ability to restore the files, rendering recovery impossible even if the ransom is paid. Initially, analysis showed many similarities with Petya ransomware samples from 2016, but further research indicated the malware had been modified to cause data destruction. Disk Destruction OverviewДЄlthough initially labeled as ransomware due to the ransom message that is displayed after infection, it appears now that NotPetya functions more as a destructive wiper-like tool than actual ransomware. In this post, we will go more into depth on the functionality and destructive capabilities of NotPetya. Therefore, it potentially only takes one infected machine in an organization to take down all systems in the network. The malware harvests SMB and user credentials from the infected host and uses those credentials to connect to other systems on the network, propagating the malware.

#Kaspersky embedded alliance partners code#

(Although the code contains the ability to spread by this exploit as well, so patching is still imperative).

In our Detecting Petya/NotPetya post, we described the way in which NotPetya (or вЂњNyetnaвЂќ as it has also been named) spreads to other systems on the network without use of the ETERNALBLUE/ETERNALROMANCE SMBv1 exploits.