rtok

RTok is a deterministic ransomware initially identified in 2022. It is designed to spread via both local and network drives, as well as removable media. The malware primarily targets Windows systems.

RTok's mechanism involves the use of AES-256 encryption to lock files on the compromised systems. Once the files are encrypted, the attacker demands a ransom in exchange for the decryption key. This type of attack is often used for financial gain.

Research indicates that the ransomware employs a self-propagation technique, spreading to other networks and computers it discovers. Additionally, it can acquire the system credentials of potential victims through the utilization of the Windows Build 20211 API, TPM 2.0.

RTok also accesses and retrieves information from the compromised computer's registry, to monitor for system shutdown, and purportedly seizes the user's accessibility settings. Furthermore, it has been found to typically insert itself to or maintain an ongoing presence on the System32 drivers folder.

Other determinants of RTok's operation include putting the user's current interface to English and for certain Windows functions not to display. Another datum is its use of in-mem mutex, or a akin inhibition path.

Experts have expressed concerns regarding the operational mechanisms employed by this type of malware. Such methods confer RTok and similar types of ransomware sizeable operational flexibility, for instance disrupting the system and the course of compromised infrastructure.