by RSS Joie Salvio, Rommel Joven and Floser Bacurio  |  Aug 17, 2017  |  Filed in: Security Research

It has just been a week since the variation of Locky named Diablo6 appeared. Now it has launched another campaign more massive than the previous. This time, it uses “.lukitus”, which means “locking” in Finnish, as the extension for the encrypted files. The FortiGuard Lion Team was the first to discover this variant with the help of Fortinet’s advanced  Kadena Threat Intelligence System (KTIS) (1)

Fig. 1 Encrypted files with .lukitus extension

Fig. 2 Familiar Locky ransom note

Same Locky, More Spam

This new campaign has launched over four times the number of email samples, we have collected from different sources, compared to the previously discovered .diablo6 campaign.

Fig. 3 Spam campaign emails of .lukitus variant

This campaign uses the following email subjects and attachment names:

 

  Subject

  Attachment Filename

 

  July-August2017.rar

  PAYMENT

  {17 numbers}.rar

  Voice Message Attached from {11 numbers} –         name unavailable

  {15 numbers}_{7 numbers}_{6 numbers}.rar

 

As in the previous campaign, the spam emails distributed in this campaign include an attached archive file (zip or rar) that contains a malicious Javascript or VBS script. Once opened, this attachment downloads the Locky payload. The following screenshot taken from KTIS summarizes this attack chain.

Fig. 4 Infection chain of .lukitus variant

In addition, the attack chain shows that some of the compromised download sites used in the previous campaign are still active, and arenow  being used to host this new variant.

Interestingly enough, this campaign seems to have been distributed mostly to Austria. In the previous campaign, Austria and the United States were virtually tied for the top spot.

Fig. 5 Spam distribution of .lukitus variant

Other new items observed in this variant include a change in the C&C’s URI from “/checkupdate.php” to “/imageload.cgi,” and it now uses ‘3’ as its affiliate ID. This affiliate has been observed distributing Locky through spam emails containing an attached compressed Javascript or VBS downloader since last year.

Solution

  1. FortiMail blocks all spam emails.
  2. FortiGuard Antivirus service detects Locky samples as W32/GenKryptik.APXF!tr.
  3. FortiGuard Webfilter service blocks and tags all download URLs as malicious.
  4. FortiSandbox rates the Locky samples as High Risk.

Conclusion

This is the first massive Locky campaign that we’ve seen in a few months. Combined with the release of a different variants just the week before, this is starting to look like an ominously familiar cycle.

FortiGuard Lion Team will keep everyone posted.

-= FortiGuard Lion Team =-

IOC

Locky Hashes:
29fc7875aac4e84fc6b5f76c9bb51eba9bb19eb4398cba5505050809b0f88035
89b769aac22faff618eb51f3b7a5b1a81790018af53630fe65e57bdf7010e735
935f4544820aa478b093ad309f46d09d92a028f7bba606a0f8c8f53b8e1f9b7a
3429c9d44de9aa8c3241601c51dc96ee82fdb4f416bb41c7b64b9ae954dce0c0
faba6d095b4a250e1fa098d7c2f5a6a1a263c409e1c2c30eefad5cedcabdf9d0
C&C:
91.228.239.216
31.202.128.249
185.80.148.137
192.162.103.213
109.237.111.179
78.108.93.185
185.75.46.220
185.17.120.130

 

https://github.com/fortiguard-lion/LockyIOCs/blob/master/Locky_Lukitus_IOC.txt


[1] Fortinet's Kadena Threat Intelligence System (KTIS) is an interactive platform that extracts contextual information from files, URLs, and other artifacts for more accurate malware identification, fast-tracked analysis, detailed analytics, and easier data correlation.

 

Sign up for weekly Fortinet FortiGuard Labs Threat Intelligence Briefs and stay on top of the newest emerging threats.

by RSS Joie Salvio, Rommel Joven and Floser Bacurio  |  Aug 17, 2017  |  Filed in: Security Research