{"id":8770,"date":"2017-08-16T11:10:12","date_gmt":"2017-08-16T19:10:12","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2017\/08\/16\/news-2543\/"},"modified":"2017-08-16T11:10:12","modified_gmt":"2017-08-16T19:10:12","slug":"news-2543","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2017\/08\/16\/news-2543\/","title":{"rendered":"Locky ransomware returns to the game with two new flavors"},"content":{"rendered":"<p><strong>Credit to Author: Marcelo Rivero| Date: Wed, 16 Aug 2017 17:57:10 +0000<\/strong><\/p>\n<p>We recently observed a fresh malicious spam campaign pushed through the Necurs botnet distributing so far, two new variants of <strong>Locky ransomware.<\/strong><\/p>\n<p>In our last <a href=\"https:\/\/blog.malwarebytes.com\/threat-analysis\/2017\/04\/cybercrime-tactics-techniques-report-for-q1-2017\/\" target=\"_blank\" rel=\"noopener\">Q2 2017 report on tactics and techniques<\/a>, we mentioned that Locky ransomware had reappeared with a new extension, but went dark again for months.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-19350 \" src=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/08\/Locky3-1.png\" alt=\"\" width=\"738\" height=\"476\" srcset=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/08\/Locky3-1.png 1434w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/08\/Locky3-1-300x194.png 300w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/08\/Locky3-1-600x387.png 600w\" sizes=\"auto, (max-width: 738px) 100vw, 738px\" \/><\/p>\n<p>From August 9th, Locky made another reappearance using a new file extension &#8220;<span style=\"color: #800000\"><strong>.diablo6<\/strong><\/span>&#8221; to encrypt files with the rescue note: &#8220;<span style=\"color: #800000\"><strong>diablo6-[random].htm<\/strong><\/span>&#8220;.<\/p>\n<p>Today a new Locky malspam campaign is pushing a new Locky variant that adds the extension &#8220;<span style=\"color: #800000\"><strong>.Lukitus<\/strong><\/span>&#8221; and the rescue note: &#8220;<span style=\"color: #800000\"><strong>lukitus.html<\/strong><\/span>&#8220;.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-19352 \" src=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/08\/L_files.png\" alt=\"\" width=\"461\" height=\"360\" srcset=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/08\/L_files.png 796w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/08\/L_files-300x234.png 300w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/08\/L_files-600x469.png 600w\" sizes=\"auto, (max-width: 461px) 100vw, 461px\" \/><\/p>\n<p>Locky, like numerous other ransomware variants, is usually distributed with the help of spam emails containing a malicious Microsoft Office file or a ZIP attachment containing a malicious script.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-19304 size-full\" src=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/08\/Nercus_MalSpam.png\" alt=\"\" width=\"1718\" height=\"947\" srcset=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/08\/Nercus_MalSpam.png 1718w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/08\/Nercus_MalSpam-300x165.png 300w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/08\/Nercus_MalSpam-600x331.png 600w\" sizes=\"auto, (max-width: 1718px) 100vw, 1718px\" \/><\/p>\n<p>Locky variants, callback to a different command and control server (C2) and use the affiliate id: AffilID3 and AffilID5.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-19305 \" src=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/08\/c2.png\" alt=\"\" width=\"450\" height=\"463\" srcset=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/08\/c2.png 770w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/08\/c2-292x300.png 292w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/08\/c2-583x600.png 583w\" sizes=\"auto, (max-width: 450px) 100vw, 450px\" \/><\/p>\n<p>Over the last few months, Locky has drastically decreased its distribution, even failed to be distributed at all, then popped back up again, vanished and reappeared once more.<\/p>\n<p>The ups and downs of Locky remain shrouded in mystery. One thing time has taught us is that we should never assume Locky is gone simply because it&#8217;s not active at a particular given time.<\/p>\n<h3><strong>Locky extension history<\/strong><\/h3>\n<h3><strong><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-19351 \" src=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/08\/Locky_ext.png\" alt=\"\" width=\"440\" height=\"274\" srcset=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/08\/Locky_ext.png 1240w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/08\/Locky_ext-300x187.png 300w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/08\/Locky_ext-600x374.png 600w\" sizes=\"auto, (max-width: 440px) 100vw, 440px\" \/><\/strong><\/h3>\n<h4><strong>Active Campaigns:<\/strong><\/h4>\n<ul>\n<li><strong>Aug-09:<\/strong> MalSpam attached .zip with .vbs malware.\n<pre> VBS: 4c1975295603dbb3994627a499416b71   Payload: 0d0823d9a5d000b80e27090754f59ee5<\/pre>\n<\/li>\n<li><strong>Aug-11:<\/strong> MalSpam attached PDF with embedded .DOCM files.\n<pre> PDF: 84fd7ba91a587cbf8e20d0f2d5fda285   DOC: 97414e16331df438b2d7da0dad75a8d5   Payload: 9dcdfbb3e8e4020e4cf2fc77e86daa76<\/pre>\n<\/li>\n<li><strong>Aug-14:<\/strong> MalSpam attached RAR with .JS malware.\n<pre> JS: badea58f10d5d2bb242962e3c47ff472   Exe: 6b4221adf0ecb55cd1a4810330b4e1e4<\/pre>\n<\/li>\n<li><strong>Aug-15: <\/strong>MalSpam attached ZIP with .JS malware.\n<pre> JS: 5f1af4f2702a6bc7f5250c9879487f66   Exe: 89ed8780cae257293f610817d6bf1a2e<\/pre>\n<\/li>\n<li><strong>Aug-16: <\/strong>MalSpam attached ZIP with .JS malware.\n<pre> JS: f2c97bd1793ff93073bfde61d12f482b   Exe: 4baa57a08c90b78d16c634c22385a748<\/pre>\n<\/li>\n<\/ul>\n<h3><strong>Protection<\/strong><\/h3>\n<p><strong><a href=\"https:\/\/www.malwarebytes.com\/premium\/\" target=\"_blank\" rel=\"noopener\">Malwarebytes<\/a><\/strong> protects against this attack at various layers including macro and ransomware mitigation, and neither of those required any signature update.<\/p>\n<p> <a href=\"https:\/\/blog.malwarebytes.com\/cybercrime\/2017\/08\/locky-ransomware-returns-to-the-game-with-two-new-flavors\/#gallery-19302-1-slideshow\">Click to view slideshow.<\/a> <\/p>\n<p>The post <a rel=\"nofollow\" href=\"https:\/\/blog.malwarebytes.com\/cybercrime\/2017\/08\/locky-ransomware-returns-to-the-game-with-two-new-flavors\/\">Locky ransomware returns to the game with two new flavors<\/a> appeared first on <a rel=\"nofollow\" href=\"https:\/\/blog.malwarebytes.com\">Malwarebytes Labs<\/a>.<\/p>\n<p><a href=\"https:\/\/blog.malwarebytes.com\/cybercrime\/2017\/08\/locky-ransomware-returns-to-the-game-with-two-new-flavors\/\" target=\"bwo\" >https:\/\/blog.malwarebytes.com\/feed\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p><strong>Credit to Author: Marcelo Rivero| Date: Wed, 16 Aug 2017 17:57:10 +0000<\/strong><\/p>\n<table cellpadding='10'>\n<tr>\n<td valign='top' align='center'><a href='https:\/\/blog.malwarebytes.com\/cybercrime\/2017\/08\/locky-ransomware-returns-to-the-game-with-two-new-flavors\/' title='Locky ransomware returns to the game with two new flavors'><img src='https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/08\/shutterstock_485738116-1.jpg' border='0'  width='300px'  \/><\/a><\/td>\n<\/tr>\n<tr>\n<td valign='top' align='left'>We recently observed a fresh malicious spam campaign pushed through the Necurs botnet distributing so far, two new variants of Locky ransomware.<\/p>\n<p>Categories: <\/p>\n<ul class=\"post-categories\">\n<li><a href=\"https:\/\/blog.malwarebytes.com\/category\/cybercrime\/\" rel=\"category tag\">Cybercrime<\/a><\/li>\n<li><a href=\"https:\/\/blog.malwarebytes.com\/category\/cybercrime\/malware\/\" rel=\"category tag\">Malware<\/a><\/li>\n<li><a href=\"https:\/\/blog.malwarebytes.com\/category\/cybercrime\/social-engineering-cybercrime\/\" rel=\"category tag\">Social engineering<\/a><\/li>\n<\/ul>\n<p>Tags: <a href=\"https:\/\/blog.malwarebytes.com\/tag\/diablo6\/\" rel=\"tag\">Diablo6<\/a><a href=\"https:\/\/blog.malwarebytes.com\/tag\/locky\/\" rel=\"tag\">Locky<\/a><a href=\"https:\/\/blog.malwarebytes.com\/tag\/locky-ransomware\/\" rel=\"tag\">Locky ransomware<\/a><a href=\"https:\/\/blog.malwarebytes.com\/tag\/lukitus\/\" rel=\"tag\">Lukitus<\/a><a href=\"https:\/\/blog.malwarebytes.com\/tag\/malspam\/\" rel=\"tag\">malspam<\/a><a href=\"https:\/\/blog.malwarebytes.com\/tag\/necurs\/\" rel=\"tag\">necurs<\/a><a href=\"https:\/\/blog.malwarebytes.com\/tag\/ransomware\/\" rel=\"tag\">ransomware<\/a><\/p>\n<table width='100%'>\n<tr>\n<td align=right>\n<p><b>(<a href='https:\/\/blog.malwarebytes.com\/cybercrime\/2017\/08\/locky-ransomware-returns-to-the-game-with-two-new-flavors\/' title='Locky ransomware returns to the game with two new flavors'>Read more&#8230;<\/a>)<\/b><\/p>\n<\/td>\n<\/tr>\n<\/table>\n<\/td>\n<\/tr>\n<\/table>\n<p>The post <a rel=\"nofollow\" href=\"https:\/\/blog.malwarebytes.com\/cybercrime\/2017\/08\/locky-ransomware-returns-to-the-game-with-two-new-flavors\/\">Locky ransomware returns to the game with two new flavors<\/a> appeared first on <a rel=\"nofollow\" href=\"https:\/\/blog.malwarebytes.com\">Malwarebytes Labs<\/a>.<\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[10488,10378],"tags":[4503,13756,10795,10971,13757,11928,3764,11977,3765,10510],"class_list":["post-8770","post","type-post","status-publish","format-standard","hentry","category-malwarebytes","category-security","tag-cybercrime","tag-diablo6","tag-locky","tag-locky-ransomware","tag-lukitus","tag-malspam","tag-malware","tag-necurs","tag-ransomware","tag-social-engineering"],"_links":{"self":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/8770","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/comments?post=8770"}],"version-history":[{"count":0,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/8770\/revisions"}],"wp:attachment":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/media?parent=8770"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/categories?post=8770"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/tags?post=8770"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}