Ransomware Recap: Oct. 24- Nov. 4, 2016

Locky, one of the most prominent ransomware families to have surfaced of late, continues to make its presence felt with updated propagation methods and infection routines. At the beginning of September, a modified version of Locky (detected by Trend Micro as RANSOM_HPLOCKY.SM51) was discovered to have adopted new routines with a variant that shows hardcoded RSA keys that allow the malware to run without the need for C&C server communication. On the other hand, by the tail-end of the same month, researchers discover a variant of Locky (with samples detected by Trend Micro as RANSOM_LOCKY.AE and RANSOM_LOCKY.AC) that appended .odin to affected files, an extension name that is new to the ransomware variant.

Interestingly, it appears that new variants of Locky are being released at a faster pace, with new variants adopting the use of new extension names more frequently than before. By the end of October, researchers have seen a new variant that appends the extension name .shit to its locked files. Samples analyzed by Trend Micro researchers (detected as RANSOM_LOCKY.DLDSAPY and RANSOM_LOCKY.DLDSAPZ) exhibit similar behaviors as seen in previously-detected variants. It arrives via spam and, when executed, will download a DLL file before carrying out its encryption routines. Another sample (detected by Trend Micro as RANSOM_LOCKY.R011H0DJP16) with a similar routine downloads an executable file. Upon encryption of target files, it renames locked files with random characters before adding the extension name.

Not long after this discovery, a new variant of Locky was observed using another extension name: .thor. This particular variant (with samples detected by Trend Micro as RANSOM_LOCKY.DLDTAPZ and RANSOM_LOCKY.THOR) is known to be distributed by spam, while other samples were seen being pushed by Sundown exploit kit. As with previous variants, it enables the download of an encrypted DLL attachment that will then be executed on the target’s machine before the encryption gets fully carried out.

During the same week, researchers discovered another ransomware variant that may look like the notorious Locky, but turned out to be a “cheap knockoff”. Named Hucky (detected by Trend Micro as RANSOM_LOCKY.DLDSAQI), or Hungarian Locky by researchers, this ransomware shares some similarities with Locky, but is simply an imitation of the original.

While most versions of Locky retrieve its public RSA key by communicating with a C&C server, Hucky has its key hardcoded in it. Once executed, this variant displays a Word document that distracts the target while its encryption routine runs in the background. Researchers also noted that Hucky only goes after half of the file types commonly encrypted by Locky. It then appends the extension, .locky and forces the infected machine to restart after the file encryption is done—a routine that has never been seen in past Locky variants.

The ransom note, targeted at Hungarian-speaking users, bears resemblance to Locky, but shows signs of it being a less sophisticated version. It contains instructions to email its operator on a provided Mail2Tor address, instead of an automated Tor website commonly used by previously-seen Locky variants.

Here are some notable ransomware stories observed in the past two weeks:

MasterBuster

Angry Duck ransomware (detected by Trend Micro as RANSOM_ANGRYDUCK.A) was discovered around the last week of October, encrypting files using AES-512 cryptography. After encryption, files are appended with the extension .adk. Following successful infection, this ransomware changes the victim’s desktop wallpaper with a ransom note containing an image of an angry duck, and a ransom demand of 10 bitcoins. The ransom amounts to almost US$ 7,300—a rather hefty sum of money compared to more common ransom prices seen of late.

LOCK93 and ISHTAR

The following week, another ransomware variant was reportedly seen predominantly targeting a Russian-speaking victim base. ISHTAR (detected by Trend Micro as RANSOM_ISHTAR.F116K3) creates a ransom note in a text file written in Russian and English. Interestingly, unlike other ransomware variants seen of late, this ransomware prepends the string ISHTAR- to each encrypted file’s file name. This means that a locked file named “sample.doc” becomes “ISHTAR-sample.doc” after encryption.

FAKELOCK.I and FAKELOCK.J


Two lockscreen ransomware were detected over the past two weeks. One variant (detected by Trend Micro as RANSOM_FAKELOCK.I) does not encrypt files found in the target systems. Instead, it disables the Command Prompt, Task Manager, and Registry Editor to prevent the victim from terminating the lockscreen. It tricks the user into believing that the encryption is ongoing by showing a loading bar that progresses and tells the user of the actions that are supposedly happening in the background.

Another variant (detected by Trend Micro as RANSOM_FAKELOCK.J) locks the target machine and displays a fake notification saying that the victim’s machine has been banned, for “unusual activity”. It asks the user to send an undisclosed fee to a “trusted Microsoft Technician,” and advises the user to contact the technician for payment instructions. The code to unlock the screen will then be supplied by the said technician once the payment has been made.

ESMERALDA and KANGAROO

Not long after Esmeralda, another Apocalypse variant called Kangaroo (with samples detected by Trend Micro as RANSOM_APOCALYPSE.F116K4 and RANSOM_APOCALYPSE.E) was spotted last week. This particular variant uses the same trick as Esmeralda, feigning a “critical problem” in its would-be victim’s Windows. Following encryption, the extension .crypted_file is added to the locked file. While the ransom price is not disclosed in the note, it provides an email address that allows victims to communicate with the developers regarding payment instructions.

JACKPOT

A multi-layered approach to defending against ransomware is key to keep all entry points in a system or a network safe from being infected. A solid backup strategy is also the most reliable way to mitigate damage from an infection.

Ransomware solutions: