Threat Spotlight: Locky Ransomware

Apparently Locky always comes back.

A persistent threat, Locky ransomware apparently has no plans of disappearing anytime soon. Locky has caused issues recently when it was used to attack Hollywood Presbyterian Medical Center during February 2016 where it claimed nearly 400,000 victims in the very first week of its detection. It was about this time that we first looked at Locky.

The largest publicly admitted ransom was paid by the Hollywood Hospital, $17,000 in Bitcoin. The second largest sum was $1,600 in Bitcoin paid by the Methodist Hospital. Since then, we have seen a lot of variants of the ransomware, named for the file extensions given to the encrypted files. Other variants we’ve seen have included zepto, thor, and osiris. Now we have Diablo6.

Little Changes in Known Malware Make it Fresh and New Again

Endpoint security is improving by the day but so are cybercriminals; this makes detecting the criminals a never-ending game of cat and mouse. It is often found that malware authors proactively monitor the detection rates of their product, allowing them to stay one step ahead of AV vendors by making improvements to their code to avoid detection. In some cases, authors can make small changes in their code to keep their malware as dangerous to the end user as it was the day they released it.

This appears to be the case the case with the Locky ransomware.  This old malware didn’t need to have anything new, as the authors behind Locky just had to tweak the only part of the process that can never be fixed - the end user. The most recent change for Locky came as one of the most popular ways to spread malware: spear phishing emails.

In this blog post, a VBS file archived via zip is dissected showing the techniques used by threat actors to avoid detection.

Our Technical Teardown

The original command-and-control server (C2) at the time of this writing is down, so I will be using INetSim to simulate the C2. INetSim is a Linux tool used to emulate common Internet services such as HTTP, HTTPS, DNS, and many others. Implemented on a REMnux virtual machine in our lab environment, INetSim will serve as a fake DNS server. This allows for the VBS script to connect to its C2 at atesbocegianaokulu [dot] com/y872ff2f. Once the DNS request is made, INetSim will act as the C2 and serve the malicious payload.

The attack happens in two stages: The first stage is the spear phishing email that has a zip archive attached, pictured in Figure 1.a. Inside the archive is a VBS file with the same name as the archive, pictured in the Figure 1.b.

Figure 1.a - Phishing Email

Figure 1.b - Zip File and VBS File

When the victim decompresses the archive, and clicks on the file, the VBS script starts to run. The script tries to connect to the C2 and download the ransomware payload as seen in the Figure 2.a and Figure 2.b:

Figure 2.a - VBS script code: the code has two different C2s separated with a dash and the name of the payload. If the VBS script can’t download the payload from the first C2 it tries to download it from the second one.

Figure 2.b - VBS Script Code New Name

The word “Enterprise” in Figure 2.b is used to avoid the malicious code detection by static analysis in an attempt to make the end user think that it is a valid component of some sort of enterprise utility. At the same time, it uses the string to split the malicious instructions, the real instructions are:

Microsoft.XMLHTTP Adodb.streaM shell.Application Wscript.shell Process Get Temp Type Open Write ResponseBody Savetofile \GlNPcFUJR.exe http: //

In Figure 3, the VBS script can be seen connecting to the C2 and downloading the payload.

Figure 3 - PCAP vbs Script

The script saves the second stage payload in the AppData/Local/Temp folder with a different name, then runs the malware as seen in Figure 4 and Figure 5.

Figure 4 -Temp Folder

Figure 5 - Stage 2 of the Malware is Running

The attack ends after encryption with the ransom message, seen below in Figure 6, then deletes itself.

Figure 6 - Ransomware Window

Now all files on the system are encrypted with Diablo6, which we already know as Locky ransomware.  Figure 6.a shows the affected files, post-encryption, with the new Diablo6 file type.

Figure 6.a - DIABLO6 Encryption

The Locky Diablo6 Ransomware will target the following file types:

.sql, .mp4, .7z, .rar, .m4a, .wma, .avi, .wmv, .csv, .d3dbsp, .zip, .sie, .sum, .ibank, .t13, .t12, .qdf, .gdb, .tax, .pkpass, .bc6, .bc7, .bkp, .qic, .bkf, .sidn, .sidd, .mddata, .itl, .itdb, .icxs, .hvpl, .hplg, .hkdb, .mdbackup, .backup, .backupdb, .syncdb, .gho, .cas, .svg, .map, .wmo, .itm, .sb, .fos, .mov, .vdf, .ztmp, .sis, .sid, .ncf, .menu, .layout, .dmp, .blob, .esm, .vcf, .vtf, .dazip, .fpk, .mlx, .kf, .iwd, .vpk, .tor, .psk, .rim, .w3x, .fsh, .ntl, .arch00, .lvl, .snx, .cfr, .ff, .vpp_pc, .lrf, .m2, .mcmeta, .vfs0, .mpqge, .kdb, .db0, .dba, .rofl, .hkx, .bar, .upk, .das, .iwi, .litemod, .asset, .forge, .ltx, .bsa, .apk, .re4, .sav, .lbf, .slm, .bik, .epk, .rgss3a, .pak, .big, wallet, .wotreplay, .xxx, .desc, .py, .m3u, .flv, .js, .css, .rb, .png, .jpeg, .txt, .p7c, .p7b, .p12, .pfx, .pem, .crt, .cer, .der, .x3f, .srw, .pef, .ptx, .r3d, .rw2, .rwl, .raw, .raf, .orf, .nrw, .mrwref, .mef, .erf, .kdc, .dcr, .cr2, .crw, .bay, .sr2, .srf, .arw, .3fr, .dng, .jpe, .jpg, .cdr, .indd, .ai, .eps, .pdf, .pdd, .psd, .dbf, .mdf, .wb2, .rtf, .wpd, .dxg, .xf, .dwg, .pst, .accdb, .mdb, .pptm, .pptx, .ppt, .xlk, .xlsb, .xlsm, .xlsx, .xls, .wps, .docm, .docx, .doc, .odb, .odc, .odm, .odp, .ods, .odt.

The domain dbr663dnbssfrodison[dot]net was recently created on August 1st, 2017 using the registrant email: jenniemarc(at)mail.com. A reverse Whois Lookup on that account shows that 333 domains were registered by this email starting in 2016 and as recently as October 2017. Some of those domains are known to be serving other families of ransomware which can be seen in the appendix. We can use this registrant and these domains to proactively detect and prevent the download of the Locky payload.

How to Stop Locky and Attacks Like It

Phishing emails can be tricky, as they’re specifically designed to trick the end user into initiating an action that they believe to be legitimate. Whether it’s opening a malicious email attachment or entering credentials to a fake Gmail or Yahoo login page, mitigating social engineering attacks can be achieved with user education. Below are some simple actions to take to help prevent these types of attacks:

1.  Never open email if you don’t know the sender.
2.  Never open a document if you don’t know where it came from.
3.  Backup your personal information constantly.

If you use our endpoint protection product, CylancePROTECT®, you are already protected from this attack.

This is one form of many different attack patterns that we are seeing. The threat can be distributed via HTML attachments disguised as invoices, Word documents embedded with malicious macro code or Visual Basic scripts (VBS), malicious URLs in spam emails, VBS, JS files archived via RAR, ZIP or 7ZIP, and DDE Office Documents.

Indicators of Compromise (IoCs)

9fe8323e5e88383283551e86bfe82518bbf68c00ae8e955fa91c738400a2d6d5
05234bcb6b5276cc39da03969be99dff7398217729dc896ef04db2fb58dd1cca
F689391B0527FBF40D425E1FFB1FAFD5C84FA68AF790E8CC4093BCC81708C11B

Atesbocegianaokulu [dot] com
dbr663dnbssfrodison [dot] net

213.142.130.106

y872ff2f.exe
GlNPcFUJR.exe

APPENDIX

Domain Name: foolerpolwer(dot)info
Creation Date: 8/4/2017
Payload: JS Locky Downloader
Hash256: 175054f99fad729d18bfc5314a162ca418f13a41e7325afe33b214c9d94aea72

Domain Name: tertrodefordown(dot)info
Creation Date: 9/21/2017
Payload: VBS Locky Downloader
Hash256: 25b6e194d57c0e2abd27c68da2815e869f089151d5581a33f8ca9e8a0b9b2de3

Domain Name: sdfsdgfsdfsdfsd(dot)info
Creation Date: 9/1/2017
Payload: Trojan Banker
Hash256: 3136fd5a06ad5b1cdc48ade31fe5fdce6c050e514f028db18230d31801592995

Domain Name: droohsdronfhystgfh(dot)info
Creation Date: 8/17/2017
Payload: Ransom Locky
Hash256: 3d653771933422f9a081ea122865da76edde83cdeb41b8b8e377833e75e21aca

Domain Name: soundgoodhj(dot)info
Creation Date: 8/6/2017
Payload: Ransom Gryphon
Hash256: 5e306f5a6aebc5c13ff92dc7de73f0618207deb925c1e4c66c25730f64caeac9

Domain Name: hg777hdorotosskot(dot)info
Creation Date: 4/12/2017
Payload: Ransom Locky
Hash256: 61897573ac9e221c42a7a1fe9d1468b6fd10911df8ffd9485deaa158505896aa

Domain Name: rateventrithathen(dot)info
Creation Date: 9/20/2017
Payload: Ransom Locky
Hash256: 6687de88bb2798f6e0e8c96fca699a59f0ecc9baecda006887c70962e76d381b

Domain Name: toplooneytopwe(dot)info
Creation Date: 6/18/2016
Payload: JS Locky Downloader
Hash256: 99e299930cf68c9c76f4a2bec7489c496e3a8f9e9c6b3e45794d6484b8151412

Domain Name: porticutoof(dot)info
Creation Date: 12/8/2016
Payload: JS Locky Downloader
Hash256: 9adb8658dd1827fbdb36d864e804f8dd5804c5ca0739affd91c4168066c4b048

Domain Name: grandfatherisgood(dot)biz
Creation Date: 9/12/2017
Payload: Trojan
Hash256: a41523a75206b6eabeacd06a33abc681e7969a396f69b3b93a802ef162aa2d6b

Domain Name: petrovichmargonovbratva(dot)biz
Creation Date: 8/4/2017
Payload: Trojan Banker
Hash256: a4a0dcb422530fc0e79adeac90583125c70b6a3ffe13d315d882bb10c7711ffb

Domain Name: unhanorarse(dot)info
Creation Date: 9/20/2017
Payload: Ransom Locky
Hash256: c35f705df9e475305c0984b05991d444450809c35dd1d96106bb8e7128b9082f

Domain Name: lollyonn(dot)info
Creation Date: 12/9/2016
Payload: JS Locky Downloader
Hash256: c8118a8efd5d201792cf1c3abeeda249036000205fab144fdbdc7fdf20aa77d7

Domain Name: ciickdomka(dot)info
Creation Date: 10/6/2017
Payload: Ransom Locky
Hash256: df255af635a2dde04c031db95862f11e1bf44fe5cfc10d3b20bd4678ed818567

Domain Name: jacklosko(dot)info
Creation Date: 10/5/2017
Payload: Ransom Locky
Hash256: eead04036eccb12ea4e27c38047bbad6899ada4cc1e9e9154c5ac1dfdedd38cc

Domain Name: tolopkedoper(dot)info
Creation Date: 10/3/2017
Payload: Ransom Locky
Hash256: f196a81eab51eadbcf3c5171c3c23ce35a7320a8434676ac9265dda2c0aec229

Domain Name: mokazylokh(dot)info
Creation Date: 10/8/2017
Payload: Trojan
Hash256: f317cd282eabf150e660619a686ac9c2af11ac59d103abaea2756c221d33af45

Domain Name: trmbobodortyuoiyrt(dot)org
Creation Date: 8/7/2017
Payload: Ransom Locky
Hash256: f689391b0527fbf40d425e1ffb1fafd5c84fa68af790e8cc4093bcc81708c11b

Domain Name: moroplinghaptan(dot)info
Creation Date: 9/20/2017
Payload: JS Locky Downloader
Hash256: fde84a9e721c55675452ed2d2f12f224e19a0a24116d3a47efe1633b1c6b404c