{
  "timestamp": "2025-02-05T23:44:57.266179",
  "content": "Search Free Trial Get Demo Locky Ransomware Now Embedded in Javascript July 21, 2016 A new wave of Locky malware emails have been making the rounds since yesterday  July 20, 2016  with a critical new development, whereby the Windows executable is now embedded in JavaScript. Essentially, the attached JavaScript file has evolved from being a downloader component into becoming the actual ransomware. These JavaScript variants were detected and blocked by CYREN as dropper trojans named JSLockyDrop.A and JSLockyDrop.A!Eldorado. The email samples used in this latest round of evolved Locky attacks are using the subject line Invoice, and use the same filename format for the attachments similar to the previous wave of Locky attacks 09AF3,_mailboxusername.zip or mailboxusername_09AF3,.zip In this article, we are showing the email sample with the SHA256 of d92e7d7c7c312940155bbe641ccb31b0258e7d75a31d0349d4ddc87e2aba22b8 in our analysis. Compared to the previous Locky emails we have been receiving, the size of the attached ZIP file in the most recent wave is significantly larger by more than 250KB. Opening the attached ZIP files shows that it still contains a javascript file. Loading the JavaScript into an editor shows the same familiar obfuscation found in the previous Locky downloader script variants. It also shows the use of numerous variables containing chunks of strings, which are concatenated at runtime to build needed strings like ActiveXObject names and methods. Even the binary decryption routine is still included in this variant. What we found new in this variant is the presence of a set of large arrays which are concatenated together. This large array variable holds the encrypted Locky ransomware binary, which is decrypted and saved to disk before being executed. Embedding malware binaries in scripts has been around for years, so it is not surprising to see Locky making use of this technique in delivering its ransomware component. At runtime wscript.exe shows significant CPU usage, indicaing the decryption of the Locky ransomware binary. The executable is saved in the windows temporary directory, with a filename which looks randomly generated, but is actually hardcoded in the javascript. The Locky ransomware component is then executed with an argument of 321. After a few minutes of execuion in the background, Locky searches, encrypts and renames files in the system. This variant adds .zepto as the file extension of the encrypted files. There have been other reports identifying this Locky ransomware variant as Zepto Ransomware, however, upon close inspection of the malware body, we found that there were just a few changes in the Locky code showing the change in file extension used. CYREN detects the dropped ransomware components as W32Locky.AN.gen!Eldorado. After encrypting files, the desktop background wallpaper is replaced with the ransom note and opens the ransom instructions page, which was dropped on the users desktop. Clicking on the Tor links directs the user to the Locky Decryptor page. As always, we highly advise end users to avoid opening executable attachments from untrusted sources, and to deploy web gateway security capable of detecting and stopping such attacks. Businesses can ultimately contribute to reducing the economic payoff calculation for the cybercriminals and, at the same time, defend their organization. For a lot more on ransomware, download our recent Cyberthreat Report devoted to Locky . Try it for Free Instant Data Classification Cyren URL Category Chacker Prev Locky Distributors Switch to Word Macro and then WSF Files CYREN Survey Benchmarks Security at SMBs  71 Hacked in the Past Year! Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443",
  "analysis_type": "user_guidance",
  "analysis": "To protect against Locky ransomware and similar threats, adopt a comprehensive security strategy that combines cautious behavior, robust tools, and best practices. Here's a structured approach:\n\n### Personal Protective Measures\n\n1. **Email Vigilance**:\n   - Be wary of emails with subjects like \"Invoice.\" Verify senders' identities and avoid clicking links or opening attachments from unfamiliar sources.\n\n2. **Avoid Executable Files**:\n   - Refrain from opening JavaScript files from untrusted sources. Adjust settings to prompt before running scripts.\n\n3. **Regular Backups**:\n   - Use external drives or cloud services for regular backups. Ensure multiple backups in different locations and periodically test restore processes.\n\n4. **Software Updates**:\n   - Enable automatic updates for your OS and software to patch vulnerabilities.\n\n5. **Antivirus and Endpoint Protection**:\n   - Use up-to-date antivirus software, considering solutions known for ransomware protection.\n\n6. **Disable Macros**:\n   - Avoid enabling macros in Office documents unless from trusted sources.\n\n### Organizational Measures\n\n7. **Educate and Train**:\n   - Conduct training sessions on email safety and threat recognition, especially for \"Invoice\" themed emails.\n\n8. **Network Security**:\n   - Ensure IT implements firewalls and intrusion detection systems to block attacks.\n\n9. **Data Security**:\n   - Use encryption for sensitive files and limit access to essential personnel.\n\n10. **Monitor Activity**:\n    - Train users to recognize suspicious activity and act quickly, disconnecting from the internet if needed.\n\n### Additional Considerations\n\n11. **Cloud Storage**:\n    - Check if cloud services offer versioning to recover previous file versions post-attack.\n\n12. **Cyber Insurance**:\n    - Explore cyber insurance options for potential loss coverage.\n\n13. **Seek Professional Help**:\n    - In case of attack, contact security experts before paying ransoms.\n\n14. **Secure Email Gateways**:\n    - Organizations should use email gateways that scan for malicious content.\n\n15. **Ad blockers and Script Blockers**:\n    - Consider using ad blockers and script blockers to reduce exposure to malicious scripts.\n\n### Conclusion\n\nProtecting against Locky ransomware involves vigilance, robust security tools, and good backup practices. By following these guidelines, individuals and organizations can significantly reduce the risk and impact of ransomware attacks. Stay informed, adapt security practices, and educate others to enhance collective safety."
}