Chuk Ransomware: Dharma Variant Encrypts Data for Easy Profit

Chuk ransomware was recently discovered by researcher xiaopao. It is a malicious program based on the Dharma ransomware strain. Chuk follows a classic infection pattern. Once it infects its host, the ransomware initiates a scan that detects all user-generated files. It is after its victims' documents, pictures, databases, archives, backups, any file that might contain valuable information.

Chuk encrypts the target files with an AES encryption algorithm that locks the files and prevents the user from accessing their content. In other words, the user can see the icons of their files but cannot open, view, or edit them.

All data locked by Chuk is easily recognizable as the ransomware adds the ".chuk" extension to them. Additionally, a unique ID and the attackers' email are also added. For example, a file named "example.docx" will be renamed to "example.docx.id-C872kj876.[tchukopchu@tutanota.com].chuk.”

Ransom Note

Following successful encryption, the ransomware drops text files named "FILES ENCRYPTED.txt," as well as opens a pop-up window that informs the victim of their unfortunate situation and lists the criminals' demands.

Ransom note text:

The ransom notes don't mention a specific ransom. Instead, the victims are instructed to contact the ransomware operators via the tchukopchu@tutanota.com email address.

Additionally, the victims are warned not to rename the encrypted files, as well as to refrain from using third-party decryption tools as such activities will increase the price for decryption.

How does Chuk infect its victims?

Chuk uses standard, mass-distribution techniques to reach its victims. It lurks behind malspam campaigns, trojans, pirated/cracked applications, and software activators.

• Malspam – From classic emails to modern instant messages, criminals use various platforms to reach a broad spectrum of potential victims. These tricksters use trending topics and write messages under the guise of well-known organizations to trick their victims into downloading malicious files or clicking onto weaponized links. Bear this in mind the next time you receive an unexpected message from your post office, bank, or the police. Proceed with caution! Treat all unexpected messages as hazardous.
• Software activators – Many people download software activators that are developed to bypass paid software activation procedures. Hackers are well aware of this fact and take full advantage of it. They upload corrupted activators that install various malware threats.
• Pirated/cracked software – Much like the software activators technique, hackers upload corrupted software copies to various web platforms.
• Trojans – Trojans infections are quite dangerous as they jeopardize your PC's security. Some trojans allow their operators to access the infected devices remotely. Others are pre-programmed to download and install additional malware on the already corrupted devices. Therefore, all trojan infections must be taken seriously and dealt with promptly!