Locky Ransomware on Rampage With JavaScript Downloader

Locky is a ransomware family that encrypts victims’ files and demands money to decrypt the files. It has infected many computers in a short time due to a huge spam campaign. It may have collected one of the largest ransoms, at least publicly announced, and made big news due to its infection of systems at a Hollywood, California, hospital and demand for payment in Bitcoins.

Propagation vector                                                                                  

Locky ransomware propagates onto victims’ systems through a widespread spam campaign using an attached Microsoft Word document with maliciously crafted macros. Recently, however, the malware has shifted to an attached, obfuscated JavaScript file. On execution it downloads Locky ransomware and installs on the victim’s computer.

We believe the change to JavaScript is to evade antimalware products due to its obfuscation and small size, which suggests the file is benign. At McAfee Labs we examined one of the JavaScript examples:

mailcontent

After extracting the file, we saw an obfuscated JavaScript whose content looks benign. After deobfuscation, however, we found Locky ransomware:

Javascriptcontent

 

Analysis

The downloaded Locky ransomware is compressed and uses a PLib-depack function for decompression. It employs the Wow64DisableWow64FsRedirection function to disable file system redirection for the calling thread.

On execution, the malware checks whether the operating system is Russian:

langcheck

If the system operating system is Russian, the malware deletes itself. Otherwise it starts the infection of the victim’s machine by adding the Locky footprint in HKCUSoftwareLocky:

Lockyregkey1

Locky calls the GetVolumeNameForVolumeMountPoint function and retrieves a volume GUID path for the volume that is associated with the specified volume mount point. From the retrieved data, using Microsoft’s cryptographic function API, the malware calculates the MD5 hash:

MD5hashalog

Later, Locky retrieves system information such as OS name, service pack, OS, language, and unique ID.

sysdatab4encryp

 

Control server communications

The collected system information is encrypted with the following encryption code:

sysdataafterencryp

After the system information is encrypted, it is posted to attacker’s control server.

C2post

The control servers are hardcoded in this sample:

  • 31[dot]41[dot]47[dot]37
  • 188[dot]138[dot]88[dot]184
  • 91[dot]121[dot]97[dot]170
  • 5[dot]34[dot]183[dot]136

The replies from the control server are decrypted by the malware with the following decryption code:

inbouddecrytion

After successful infection the malware stores user ID, ransom note and RSA public key, and completed value name under the Locky registry key:

lockyregkey2

Encrypted file types 

The malware searches and encrypts the victim’s files with the following file extensions and renames them with .locky.

filetypeencryption

Ransomware notice 

After file encryption, the malware changes the desktop background to the recovery-instruction image, which clearly states the procedure to get the private key and decrypt the files.

notice

On following the link to get private key, the victim lands on the payment procedure page, and can buy the Locky decryptor:

lockydecyptor

Detection coverage

All Intel Security products detect the JavaScript and downloaded Locky file as malicious.

filedetection1filedetection2

 

Sample MD5s:

  • 2C01D031623AADA362D9CC9C7573B6AB
  • 3F118D0B888430AB9F58FC2589207988

The post Locky Ransomware on Rampage With JavaScript Downloader appeared first on McAfee.