{"id":6341,"date":"2017-01-23T15:50:28","date_gmt":"2017-01-23T23:50:28","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2017\/01\/23\/news-179\/"},"modified":"2017-01-23T15:50:28","modified_gmt":"2017-01-23T23:50:28","slug":"news-179","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2017\/01\/23\/news-179\/","title":{"rendered":"Don\u2019t let this Black Friday\/Cyber Monday spam deliver Locky ransomware to you"},"content":{"rendered":"

We see it every year: social engineering attacks that take advantage of the online shopping activities around Black Friday and Cyber Monday, targeting customers of online retailers. This year, we\u2019re seeing a spam campaign that Amazon customers need to be wary of. The fake emails pretend to be notifications from\u00a0the online retailer\u00a0that a purchase has been sent out for delivery. To appear legitimate, the emails may also spoof delivery companies.<\/p>\n

These email messages start an infection chain that leads to a ransomware<\/a> infection. You don\u2019t want to find yourself at the end of this chain, because by then, your files will have been encrypted by the malware.<\/p>\n

\"blackfridayspam3\"<\/p>\n

Figure 1: The Black Friday\/Cyber Monday\u00a0themed spam triggers an infection chain that leads to a ransomware infection<\/em><\/p>\n

But, as it\u2019s a chain of events, you can stop the infection at several points. Let\u2019s trace the infection chain:<\/p>\n

    \n
  1. The email is a fake Amazon notification. You can detect that it\u2019s fake, because even if it tries to look as legitimate as possible, it still doesn\u2019t look like the usual Amazon email. Amazon lists components of a fake email here: https:\/\/www.amazon.com\/gp\/help\/customer\/display.html?nodeId=15835501<\/a><\/li>\n
  2. The attachment is a ZIP file. Don\u2019t open this attachment.\u00a0\u00a0It contains as JavaScript (.js) file, not a file type often sent in legitimate email communications.<\/span><\/li>\n
  3. The JavaScript in the ZIP file is obfuscated. Don\u2019t open this script. It\u2019s a Nemucod<\/a> malware that downloads the payload. Windows Defender<\/a> detects this JavaScript downloader.<\/li>\n
  4. The downloaded file is a ransomware detected as Ransom:Win32\/Locky.A<\/a>. Windows Defender<\/a> detects this malware.<\/li>\n<\/ol>\n

    Locky<\/a> is a ransomware family that encrypts files using a public key. It\u2019s been known to be spread by the downloader Nemucod<\/a>. We have been tracking the Nemucod-Locky<\/a> tandem, and we have seen it evolve over time, changing attachment file names and social engineering lures. This Black Friday\/Cyber Monday\u00a0version is just the latest of what looks like a continuous campaign.<\/p>\n

    Here are samples of the fake Amazon email messages:<\/p>\n

    \"black-friday-email-1\"<\/p>\n

    Figure 2: A sample fake Amazon email that also spoofs Royal Mail as the courier<\/em><\/p>\n

    \"black-friday-email-2\"<\/p>\n

    Figure 3: A sample fake Amazon email that also spoofs FedEx as the courier<\/em><\/p>\n

    \"black-friday-email-3\"<\/p>\n

    Figure 4: A sample fake Amazon email that also spoofs DHL as the courier<\/em><\/p>\n

    In what looks like an attempt to evade anti-spam solutions that depend on the hash of the email body, the character “=” is added in random places in the email. The malware authors could have reused the message from a previous spam campaign, and needed only to change the positions of the added character. This changes the hash of the email body, and\u00a0it might prove effective against some email filters.<\/p>\n

    The email attachment is a ZIP file that contains an obfuscated JavaScript (.js) file, detected as\u00a0TrojanDownloader:JS\/Nemucod<\/a>:<\/p>\n

    \"black-friday-spam-javascript-in-zip\"<\/p>\n

    Figure 5: The ZIP attachment contains a malicious JavaScript file<\/em><\/p>\n

    \"black-friday-spam-obfuscated-javascript\"<\/p>\n

    Figure 6: The JavaScript file is obfuscated<\/em><\/p>\n

    When opened, the JavaScript connects to the following URLs to download a file:<\/p>\n