Search Results: Locky


We’re Up All Night to Get Locky

VB 2016 Presentation – Oct 5-7, Denver When we first saw and analyzed Locky back in... note was multilingual. The conclusion of our first Locky blog reads: “We also predict that... Locky ransomware will be a major player in the ransomware scene. Fortinet will continue to monitor... developments regarding this malware”. As predicted, Locky has become a major ransomware menace... we’ve decided to raise the bar and share even more information about Locky! We will be

Cracking Locky’s New Anti-Sandbox Technique

The last few weeks saw new variants of the Locky ransomware that employs a new anti-sandbox... technique. In these new variants, Locky’s loader code uses a seed parameter from its JavaScript... downloaded Locky executable is executed by the JavaScript in the following manner: sample.exe 123... Below is a screenshot of it in action: This new trick may pose challenges for automated Locky... tracking systems that utilize sandboxing due to the following considerations: New Locky binaries

The Locky Saga Continues: Now Uses .odin as File Extension

As a result of our continuous monitoring of the Locky ransomeware we discovered a new Locky variant... some of its other minor updates. It’s not Odin. It’s Locky    ...;  The transition from “.locky” to “.zepto” extension has caused some... new ransomware family, when in fact, it’s just a new variant of the infamous Locky ransomware... .locky, BinDiff scored it with a striking 85% similarity. These similarities are almosy entirely

Locky Launches a More Massive Spam Campaign with New “Lukitus” Variant

It has just been a week since the variation of Locky named Diablo6 appeared. Now it has... Fig. 2 Familiar Locky ransom note Same Locky, More Spam This new campaign has launched over... malicious Javascript or VBS script. Once opened, this attachment downloads the Locky payload. The... uses ‘3’ as its affiliate ID. This affiliate has been observed distributing Locky through.... Solution FortiMail blocks all spam emails. FortiGuard Antivirus service detects Locky samples as

A Closer Look at Locky Ransomware

A new ransomware named “Locky” is currently circulating in the wild and making the headlines. There... are some good reports regarding Locky ransomware already available over the Internet. This blog... Harry71’s Onion Spider, the Locky decryptor page became available on February 6, 2016 which may indicate..., Locky ransomware calls RDTSC function to get a timestamp counter. It then implements modulo... actors behind Locky are experienced cybercriminals. The way the ransomware is designed resembles

CryptoWall, TeslaCrypt and Locky: A Statistical Perspective

It’s been over two weeks since we reported about Locky and predicted that it will be a major... statistics for CryptoWall, TeslaCrypt and Locky two weeks after (Feb 17th to March 2nd) to see how... Locky is doing and where it sits compared to its more seasoned counterparts. While the statistics... cover a short timeframe, it does give some insights not only on Locky’s early operations but..., TeslaCrypt and Locky C&C communications. It is important to consider that when analysing IPS hits

Locky Unleashes Multiple Spam Waves with a New Variant “ykcol“

While FortiGuard Labs was preparing for another presentation on our Locky research at the Black... Intelligence System (KTIS)1 caught another Locky variant using a new extension – “ykcol...” or “locky” spelled backwards. Locky has been stepping up its game over the... related URLs) At the same point in time, compromised URLs in the same wave lead to the same locky... sample when downloaded. A wave can deliver Locky samples with either online or offline encryption

A New Variant of Locky Leaking Out

Locky, the professional grade ransomware has been causing headaches and damages to victim’s... files on the victims’ computers with an additional‘.locky’ as extension which is... what the ransomware is named after. Locky is professionally written, massively spread, costly if... upgrade until recently. Our VEX system captured a new variant Locky sample at the beginning of last week... same IP in communication. Same IP but Different URI Locky contains 3 to 6 hardcoded IP addresses

Locky NSIS-based Ransomware is Embracing Its New End of Summer Shape

Over the last few months we saw that Locky’s loader uses seed parameter to execute properly... parameter. Afterwards, we saw Locky shift itself from an EXE to Dynamic Link Library (DLL). We... recently encountered yet another Locky development, where binary strains are using the Nullsoft... from its Nullsoft package loader. Decompressing Locky’s Nullsoft Package Using 7zip, we... Locky NSIS sample The first file of interest from the decompressed files is “[NSIS].nsi&rdquo

Japanese Trends in the Aggressive Activity of the "Locky" Ransomware

The Locky ransomware has shown no signs of slowing down its aggressive activity since it was first... threat. The following report on Locky trends within Japan is based on information reported to FortiGuard... technical perspective. Command and Control Communications of the Locky Botnet According to... FortiGuard, Locky-related Botnet communications currently have the tenth highest number of detections.... As mentioned in the beginning of this article, Locky is a new type of ransomware which was only