New DeriaLock Ransomware Active on Christmas, Includes An ‘Unlock All’ Command

Today, on Christmas Eve, G Data malware analyst Karsten Hahn has come across a new ransomware family named DeriaLock, which locks your screen and requests a payment of $30.

Ransomware families generally fall in one of two categories: screen lockers (which prevent access to your computer but leave your files alone) and crypto lockers (which allow you to use your computer but encrypt all your files).

DeriaLock is from the first category, of ransomware families that lock your screen and prevent users from accessing their files or applications but leaving the data intact.

Discovered today after an anonymous user has uploaded a copy of the ransomware’s binary on VirusTotal, there’s no information on how the ransomware currently spreads.

Once launched into execution, DeriaLock will take the computer’s MachineName identifier and generate an MD5 hash. Since malware authors often infect themselves by accident, the DeriaLock source code includes a hard-coded MD5 hash, for which the screen locker won’t start. This MD5, seen below, most likely belongs to DeriaLock’s author.

After checking the MD5 locally, the ransomware then contacts its command and control (C&C) server and retrieves the most current version of itself, saving the file at:

C:\users\appdata\roaming\microsoft\windows\start menu\programs\startup\SystemLock.exe

DeriaLock will then run this file, which now passes all checks and starts the screen-locking behavior by showing a fullscreen window with the following ransom note:

The HWID displayed in the ransom note is the same MD5 hash generated previously.

The screen locker window also includes two buttons that when clicked, provide translations of the ransom note in German and Spanish. Only the German translation button works.

According to Hahn, there was no trace of any Spanish text inside the ransomware’s source code, which is the reason why the Spanish translation doesn’t show anything.

Below is an image of what happens when users press the German translation button.

Both the English and German ransom notes are full of spelling errors.

In order to keep users from closing the screen-locking window, DeriaLock will search and kill the following processes:

Additionally, if users press the ALT + F4 keyboard shortcut to close the screen locker, a popup appears that reads: “I think that is a bad decision. Nice try mate =)”

If the victim wants to pay the ransom, he must take the HWID, contact the DeriaLock author via Skype, and send the crook $30 through an unknown payment method.

The DeriaLock operator takes this HWID and places it on his server in the form of a text file named: https://server-address/[full_MD5_hash].txt

The content of this file is the DeriaLock unlock code. When the victim’s infected computer will query the C&C server the next time, it will discover this file, determine that the victim has paid, take the code and unlock the user’s computer, as shown from the code snippet below.

At the time of writing, Hahn says that the DeriaLock servers are still up and running, meaning the threat is currently being distributed to unsuspecting victims.

Furthermore, Hahn has also discovered that during its regular C&C server query routine, DeriaLock also checks the server for the presence of a special text file.

Based on the file’s name (unlock-everybody.txt), we presume that this is a method of removing the screen locker from all infected computers at once.

WinRAR and ZIP File Exploits: This ZIP File Hack Could Let Malware Bypass Your Antivirus

5 Techniques Hackers Use to Jailbreak ChatGPT, Gemini, and Copilot AI systems

This Hacker Toolkit Can Breach Any Air-Gapped System – Here’s How It Works

Hacking Pagers to Explosions: Israel’s Covert Cyber-Physical Sabotage Operation Against Hezbollah!

Five Techniques for Bypassing Microsoft SmartScreen and Smart App Control (SAC) to Run Malware in Windows

How Millions of Phishing Emails were Sent from Trusted Domains: EchoSpoofing Explained

How to implement Principle of Least Privilege(Cloud Security) in AWS, Azure, and GCP cloud

The 11 Essential Falco Cloud Security Rules for Securing Containerized Applications at No Cost

Alisa Esage G

Working as a cyber security solutions architect, Alisa focuses on application and network security. Before joining us she held a cyber security researcher positions within a variety of cyber security start-ups. She also experience in different industry domains like finance, healthcare and consumer products.