{
  "timestamp": "2025-02-05T23:42:19.476026",
  "content": "Search Free Trial Get Demo Locky Ransomware Now Embedded in Javascript July 21, 2016 A new wave of Locky malware emails have been making the rounds since yesterday  July 20, 2016  with a critical new development, whereby the Windows executable is now embedded in JavaScript. Essentially, the attached JavaScript file has evolved from being a downloader component into becoming the actual ransomware. These JavaScript variants were detected and blocked by CYREN as dropper trojans named JSLockyDrop.A and JSLockyDrop.A!Eldorado. The email samples used in this latest round of evolved Locky attacks are using the subject line Invoice, and use the same filename format for the attachments similar to the previous wave of Locky attacks 09AF3,_mailboxusername.zip or mailboxusername_09AF3,.zip In this article, we are showing the email sample with the SHA256 of d92e7d7c7c312940155bbe641ccb31b0258e7d75a31d0349d4ddc87e2aba22b8 in our analysis. Compared to the previous Locky emails we have been receiving, the size of the attached ZIP file in the most recent wave is significantly larger by more than 250KB. Opening the attached ZIP files shows that it still contains a javascript file. Loading the JavaScript into an editor shows the same familiar obfuscation found in the previous Locky downloader script variants. It also shows the use of numerous variables containing chunks of strings, which are concatenated at runtime to build needed strings like ActiveXObject names and methods. Even the binary decryption routine is still included in this variant. What we found new in this variant is the presence of a set of large arrays which are concatenated together. This large array variable holds the encrypted Locky ransomware binary, which is decrypted and saved to disk before being executed. Embedding malware binaries in scripts has been around for years, so it is not surprising to see Locky making use of this technique in delivering its ransomware component. At runtime wscript.exe shows significant CPU usage, indicaing the decryption of the Locky ransomware binary. The executable is saved in the windows temporary directory, with a filename which looks randomly generated, but is actually hardcoded in the javascript. The Locky ransomware component is then executed with an argument of 321. After a few minutes of execuion in the background, Locky searches, encrypts and renames files in the system. This variant adds .zepto as the file extension of the encrypted files. There have been other reports identifying this Locky ransomware variant as Zepto Ransomware, however, upon close inspection of the malware body, we found that there were just a few changes in the Locky code showing the change in file extension used. CYREN detects the dropped ransomware components as W32Locky.AN.gen!Eldorado. After encrypting files, the desktop background wallpaper is replaced with the ransom note and opens the ransom instructions page, which was dropped on the users desktop. Clicking on the Tor links directs the user to the Locky Decryptor page. As always, we highly advise end users to avoid opening executable attachments from untrusted sources, and to deploy web gateway security capable of detecting and stopping such attacks. Businesses can ultimately contribute to reducing the economic payoff calculation for the cybercriminals and, at the same time, defend their organization. For a lot more on ransomware, download our recent Cyberthreat Report devoted to Locky . Try it for Free Instant Data Classification Cyren URL Category Chacker Prev Locky Distributors Switch to Word Macro and then WSF Files CYREN Survey Benchmarks Security at SMBs  71 Hacked in the Past Year! Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443",
  "analysis_type": "comprehensive",
  "analysis": "**Comprehensive Analysis of Locky Ransomware Embedded in JavaScript**\n\n1. **Key Security Features and Their Benefits to Users:**\n   - **Detection and Blocking:** The cybersecurity solution, CYREN, effectively detects and blocks the JavaScript files as dropper trojans (JSLockyDrop.A and JSLockyDrop.A!Eldorado), preventing the attack early and reducing the risk of infection.\n   - **Real-Time Monitoring:** The solution offers continuous monitoring, essential for identifying and mitigating threats as they emerge, especially with evolving ransomware techniques.\n\n2. **Compliance Certifications and Regulatory Adherence:**\n   - The content does not explicitly mention compliance certifications, but adherence to standards like GDPR is implicitly suggested through effective data protection and privacy measures. Enhancing this with explicit compliance details would improve clarity.\n\n3. **User-Focused Security Recommendations:**\n   - **Caution with Attachments:** Users should avoid opening attachments from untrusted sources, especially those with generic subjects like \"Invoice.\"\n   - **Antivirus and Updates:** Regularly update software and use reliable antivirus programs to detect and remove threats.\n   - **Backups:** Maintain secure, off-network backups to recover data in case of an attack.\n\n4. **Technical Security Implementation Details:**\n   - **Obfuscation and ActiveXObject:** The ransomware uses JavaScript obfuscation and ActiveXObject to hide malicious activities, making detection challenging.\n   - **Execution Process:** The ransomware saves itself to the temp directory and executes with specific arguments, highlighting the need for monitoring script execution.\n\n5. **Data Protection Measures:**\n   - **Backups:** Ensure data is backed up securely and regularly to restore files without paying ransom.\n   - **Network Segmentation:** Isolate infected devices quickly to prevent lateral movement and further damage.\n   - **Encryption:** Focus on securing sensitive data to prevent unauthorized access.\n\n6. **Best Practices for End Users:**\n   - **Email Security:** Implement robust email filtering and gateways to block malicious attachments.\n   - **Application Whitelisting:** Restrict execution of unrecognized applications to prevent unauthorized code execution.\n   - **User Education:** Regularly train users to recognize phishing attempts and suspicious emails.\n\n7. **Additional Considerations:**\n   - **Incident Response Plans:** Businesses should have clear plans for responding to ransomware incidents, including containment and recovery strategies.\n   - **Data Loss Prevention:** Implement measures to detect and prevent sensitive data exfiltration.\n\nBy understanding and implementing these strategies, users and organizations can enhance their resilience against evolving ransomware threats like Locky."
}