ISP Email Delivers Locky Ransomware
Posted by: Timothy Weaver on 11/23/2016 12:46 PM
[
Comments
]
Cyber criminals are sending out fake emails pretending to be from the users ISP saying they have noticed spam emails being sent from the users account.
The email contains a zip attachment titled Logs_(Users Name)_zip. When opened, the zip file contains a java script which will download a dll file that carries the ransomware.
One of the methods used to avoid detection has been changing the extension. The original variant used the .locky extension, but the crooks have been very diligent about changing it often. They have changed it to .ZEPTO, .ODIN, and .THOR since. The most recent type is .AESIR.
That is not the only change. The method of delivery has also been changed from a Word documents with malicious macros to other types of files including java scripts, WSF, DLLs, and more.
“The reason for Locky’s continued growth is the constant variation and expansion of its distribution mechanism, which is primarily through spams emails. Its creators are continually changing the type of files used for downloading the ransomware, including doc, xls and wsf files, as well as making significant structural changes to the spam emails,” Check Point says.
Source: Security Week
The email contains a zip attachment titled Logs_(Users Name)_zip. When opened, the zip file contains a java script which will download a dll file that carries the ransomware. One of the methods used to avoid detection has been changing the extension. The original variant used the .locky extension, but the crooks have been very diligent about changing it often. They have changed it to .ZEPTO, .ODIN, and .THOR since. The most recent type is .AESIR.
That is not the only change. The method of delivery has also been changed from a Word documents with malicious macros to other types of files including java scripts, WSF, DLLs, and more.
“The reason for Locky’s continued growth is the constant variation and expansion of its distribution mechanism, which is primarily through spams emails. Its creators are continually changing the type of files used for downloading the ransomware, including doc, xls and wsf files, as well as making significant structural changes to the spam emails,” Check Point says.
Source: Security Week
Comments
