Locky is Back Asking for Unpaid Debts[html]
On June 21, 2016, FireEye’s Dynamic Threat Intelligence (DTI)
identified an increase in JavaScript contained within spam emails.
FireEye analysts determined the increase was the result of a new Locky
ransomware spam campaign.
As shown in Figure 1, Locky spam activity was uninterrupted until
June 1, 2016, when it stopped for nearly three weeks. During this
period, Locky was the most dominant ransomware distributed in spam
email. Now, Locky distribution has returned to the level seen during
the first half of 2016.
Figure 1. Locky spam activity in 2016
Figure 2 shows that the majority of Locky spam email detections
between June 21 and June 23 of this year were recorded in Japan, the
United States and South Korea.
Figure 2. Locky spam by country from June 21 to
June 23 of this year
The spam email – a sample shown is shown in Figure 3 – purports to
contain an unpaid invoice in an attached ZIP archive. Instead of an
invoice, the ZIP archive contains a Locky downloader written in JavaScript.
Figure 3. Locky spam email
JavaScript based Downloader Updates
In this campaign, few updates were seen in both the JavaScript based
downloader and the Locky payload.
The JavaScript downloader does the following:
- Iterates over an array of URLs hosting the Locky payload.
- If a connection to one of the URLs fails, the JavaScript sleeps
for 1,000 ms before continuing to iterate over the array of
URLs. - Uses a custom XOR-based decryption routine to decrypt
the Locky payload. - Ensures the decrypted binary is of a
predefined size. In Figure 4 below, the size of the decrypted binary
had to be greater than 143,360 bytes and smaller than 153,660 bytes
to be executed.
Figure 4. Payload download function in JavaScript
5.
