Locky Ransomware on Rampage With JavaScript Downloader

Locky is a ransomware family that encrypts victims’ files and demands money to decrypt the files. It has infected many computers in a short time due to a huge spam campaign.

Propagation vector                                                                                  

Locky ransomware propagates onto victims’ systems through a widespread spam campaign using an attached Microsoft Word document with maliciously crafted macros. Recently, however, the malware has shifted to an attached, obfuscated JavaScript file. On execution it downloads Locky ransomware and installs on the victim’s computer.

We believe the change to JavaScript is to evade antimalware products due to its obfuscation and small size, which suggests the file is benign. At McAfee Labs we examined one of the JavaScript examples:

After extracting the file, we saw an obfuscated JavaScript whose content looks benign. After deobfuscation, however, we found Locky ransomware:

Analysis

The downloaded Locky ransomware is compressed and uses a PLib-depack function for decompression. It employs the Wow64DisableWow64FsRedirection function to disable file system redirection for the calling thread.

On execution, the malware checks whether the operating system is Russian:

If the system operating system is Russian, the malware deletes itself. Otherwise it starts the infection of the victim’s machine by adding the Locky footprint in HKCU\Software\Locky:

Locky calls the GetVolumeNameForVolumeMountPoint function and retrieves a volume GUID path for the volume that is associated with the specified volume mount point. From the retrieved data, using Microsoft’s cryptographic function API, the malware calculates the MD5 hash:

Later, Locky retrieves system information such as OS name, service pack, OS, language, and unique ID.

Control server communications

The collected system information is encrypted with the following encryption code:

After the system information is encrypted, it is posted to attacker’s control server.

The control servers are hardcoded in this sample:

• 31[dot]41[dot]47[dot]37
• 188[dot]138[dot]88[dot]184
• 91[dot]121[dot]97[dot]170
• 5[dot]34[dot]183[dot]136

The replies from the control server are decrypted by the malware with the following decryption code:

After successful infection the malware stores user ID, ransom note and RSA public key, and completed value name under the Locky registry key:

Encrypted file types 

The malware searches and encrypts the victim’s files with the following file extensions and renames them with .locky.

Ransomware notice 

After file encryption, the malware changes the desktop background to the recovery-instruction image, which clearly states the procedure to get the private key and decrypt the files.

On following the link to get private key, the victim lands on the payment procedure page, and can buy the Locky decryptor:

Detection coverage

All McAfee products detect the JavaScript and downloaded Locky file as malicious.

Sample MD5s:

• 2C01D031623AADA362D9CC9C7573B6AB
• 3F118D0B888430AB9F58FC2589207988

Update March 8: Locky is not the ransomware associated with the recent well-publicized attack on a Southern California hospital.