Introduction
Retch is a new ransomware variant first discovered in mid-August 2023. It encrypts files on compromised machines and leaves two ransom notes asking victims to pay a ransom for file decryption.
Target system:
Windows(R) Operating Systems (OS)
Spreading ways:
Downloaded files, phishing emails containing malicious attachments, hidden within a Trojan file.
Ransomware
Encrypts data files, picture files, office documents, music, and many other kinds of files in the victim Windows PC or server, except files in the following directories:
“Windows”
“Program Files”
“Program Files (x86)”
The ransomware adds a “.retch” extension to encrypted files.
It generates a plain text file named “Message.txt” in every folder, with files that are already encrypted. In the same file, the attacker asks victims to pay Bitcoins for file decryption.
In addition, the attacker downloads another file on the Desktop labeled “HOW TO RECOVER YOUR FILES.txt” and asks victims to pay Bitcoin worth $1000 for file decryption. This ransom note has a contact email address and the attacker’s Bitcoin wallet address.
Already Known Retch File Hash Value:
c0abe65d207faf04c99b7c32fe08edaf,
db259549b6a6d2886360c2e30aae6e2c,
7775825b7abdaed99d1bc135393ed739,
3d5784635678e43f184a2a5263445383,
740931337c54ad5ee9e03b9af44aa316
Protect against Retch Ransomware
CloudVista-Cyber Threat Intelligence from Hillstone has already published Retch Ransomware information.
Retch Ransomware file signature has already been included in the latest Anti-Virus Signature database. Users need to update the Anti-Virus Signature database to version 2.3.231102 or above.
