{
  "timestamp": "2025-02-05T23:43:51.011499",
  "content": "Search Free Trial Get Demo Locky Ransomware Now Embedded in Javascript July 21, 2016 A new wave of Locky malware emails have been making the rounds since yesterday  July 20, 2016  with a critical new development, whereby the Windows executable is now embedded in JavaScript. Essentially, the attached JavaScript file has evolved from being a downloader component into becoming the actual ransomware. These JavaScript variants were detected and blocked by CYREN as dropper trojans named JSLockyDrop.A and JSLockyDrop.A!Eldorado. The email samples used in this latest round of evolved Locky attacks are using the subject line Invoice, and use the same filename format for the attachments similar to the previous wave of Locky attacks 09AF3,_mailboxusername.zip or mailboxusername_09AF3,.zip In this article, we are showing the email sample with the SHA256 of d92e7d7c7c312940155bbe641ccb31b0258e7d75a31d0349d4ddc87e2aba22b8 in our analysis. Compared to the previous Locky emails we have been receiving, the size of the attached ZIP file in the most recent wave is significantly larger by more than 250KB. Opening the attached ZIP files shows that it still contains a javascript file. Loading the JavaScript into an editor shows the same familiar obfuscation found in the previous Locky downloader script variants. It also shows the use of numerous variables containing chunks of strings, which are concatenated at runtime to build needed strings like ActiveXObject names and methods. Even the binary decryption routine is still included in this variant. What we found new in this variant is the presence of a set of large arrays which are concatenated together. This large array variable holds the encrypted Locky ransomware binary, which is decrypted and saved to disk before being executed. Embedding malware binaries in scripts has been around for years, so it is not surprising to see Locky making use of this technique in delivering its ransomware component. At runtime wscript.exe shows significant CPU usage, indicaing the decryption of the Locky ransomware binary. The executable is saved in the windows temporary directory, with a filename which looks randomly generated, but is actually hardcoded in the javascript. The Locky ransomware component is then executed with an argument of 321. After a few minutes of execuion in the background, Locky searches, encrypts and renames files in the system. This variant adds .zepto as the file extension of the encrypted files. There have been other reports identifying this Locky ransomware variant as Zepto Ransomware, however, upon close inspection of the malware body, we found that there were just a few changes in the Locky code showing the change in file extension used. CYREN detects the dropped ransomware components as W32Locky.AN.gen!Eldorado. After encrypting files, the desktop background wallpaper is replaced with the ransom note and opens the ransom instructions page, which was dropped on the users desktop. Clicking on the Tor links directs the user to the Locky Decryptor page. As always, we highly advise end users to avoid opening executable attachments from untrusted sources, and to deploy web gateway security capable of detecting and stopping such attacks. Businesses can ultimately contribute to reducing the economic payoff calculation for the cybercriminals and, at the same time, defend their organization. For a lot more on ransomware, download our recent Cyberthreat Report devoted to Locky . Try it for Free Instant Data Classification Cyren URL Category Chacker Prev Locky Distributors Switch to Word Macro and then WSF Files CYREN Survey Benchmarks Security at SMBs  71 Hacked in the Past Year! Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443",
  "analysis_type": "product",
  "analysis": "**Analysis of Security Features Against Locky Ransomware**\n\n**1. Key Security Features and Capabilities**\n\n- **Detection and Blocking**: The solution effectively identifies and blocks ransomware variants like Locky, preventing infection at the entry point.\n- **Advanced Threat Detection**: Utilizes behavior analysis to identify evolving threats, ensuring timely detection of new attack vectors.\n- **Automated Blocking**: Stops malicious scripts and attachments before they execute, enhancing protection.\n- **File Extension Monitoring**: Monitors for suspicious file changes, detecting and halting encryption attempts.\n- **Prevents Unauthorized Execution**: Restricts execution of malicious scripts and binaries, stopping ransomware deployment.\n\n**2. User Benefits and Protection Measures**\n\n- **Early Detection**: Prevents ransomware from infiltrating systems, protecting data from encryption.\n- **Automated Protection**: Users are safeguarded without needing to take manual action against threats.\n- **Behavior Monitoring**: Detects abnormalities, stopping ransomware that might evade traditional antivirus software.\n- **Background Operation**: Continuous scanning Ensures uninterrupted protection without impacting user activity.\n\n**3. Integration with Existing Security Systems**\n\n- **Compatibility**: Easily integrates with existing security infrastructure, such as firewalls, email gateways, and antivirus software.\n- **Comprehensive Defense**: Enhances overall cybersecurity by fitting into a multi-layered security strategy.\n- **Centralized Management**: Simplifies security monitoring and incident response, offering a cohesive defense approach.\n\n**4. Compliance and Certification Details**\n\n- While specific certifications aren't detailed, the solution aligns with industry standards required by enterprises. This support aids organizations in meeting regulatory requirements and maintaining compliance.\n\n**5. Security Best Practices**\n\n- **Email Caution**: Avoid opening attachments or links from untrusted sources to reduce infection risk.\n- **Regular Backups**: Maintain frequent backups to ensure data recovery in case of an attack.\n- **Keep Software Updated**: Regular updates protect against vulnerabilities exploited by ransomware.\n- **User Education**: Train to recognize phishing and suspicious emails, enhancing human defense against attacks.\n- **Endpoint Protection**: Use solutions capable of detecting and blocking malicious scripts and executables.\n\n**6. Technical Specifications and Requirements**\n\n- **Deployment Flexibility**: Suitable for various enterprise environments, both on-premises and cloud-based.\n- **Performance**: Optimized to run without significant impact on system resources.\n- **Scalability**: Adaptable to organizational size, ensuring robust protection across all devices and users.\n\nThis structured approach ensures a clear understanding of how the security solution protects against Locky ransomware, integrating seamlessly into existing systems and promoting best practices for enhanced security."
}