تقریبا هفته گذشته بود که بدافزار لوکی با گونۀ تازه ای، به نام: Diablo6 آشکار شد. اکنون دوباره این بدافزار، کمپین هرزنامه -ای جدیدی راه انداخته است که بزرگتر از حمله پیشین است. این بار بدافزار لوکی از پسوند lukitus برای فایل های رمزنگاری استفاده می کند که به معنای قفل کردن در زبان فلاندی است. این نوع از بدافزار لوکی توسط تیم امنیتی FortiGuard شناسایی شده است. مانند کمپین های گذشته، هرزنامه های انتشار دهندۀ این بدافزار دارای پیوست با فرمت ZIP یا RAR هستند که شامل یک نویسه VBS یا جاوااسکریپت می شود. هنگامیکه این نویسه ها باز و اجرا شوند، بدافزار لوکی دانلود شده است و روی سامانه اجرا می شود. با توجه به بررسی های صورت گرفته تاکنون، بیشترین قربانیان این نوع بدافزار در آمریکا و اتریش بوده اند.

It has just been a week since the variation of Locky named Diablo6 appeared. Now it has launched another campaign more massive than the previous. This time, it uses “.lukitus”, which means “locking” in Finnish, as the extension for the encrypted files. The FortiGuard Lion Team was the first to discover this variant with the help of Fortinet’s advanced  Kadena Threat Intelligence System (KTIS) (1)

Fig. 1 Encrypted files with .lukitus extension

Fig. 2 Familiar Locky ransom note

Same Locky, More Spam

This new campaign has launched over four times the number of email samples, we have collected from different sources, compared to the previously discovered .diablo6 campaign.

Fig. 3 Spam campaign emails of .lukitus variant

This campaign uses the following email subjects and attachment names:

Subject	Attachment Filename
	July-August2017.rar
PAYMENT	{17 numbers}.rar
Voice Message Attached from {11 numbers} –         name unavailable	{15 numbers}_{7 numbers}_{6 numbers}.rar

As in the previous campaign, the spam emails distributed in this campaign include an attached archive file (zip or rar) that contains a malicious Javascript or VBS script. Once opened, this attachment downloads the Locky payload. The following screenshot taken from KTIS summarizes this attack chain.

Fig. 4 Infection chain of .lukitus variant

In addition, the attack chain shows that some of the compromised download sites used in the previous campaign are still active, and arenow  being used to host this new variant.

Interestingly enough, this campaign seems to have been distributed mostly to Austria. In the previous campaign, Austria and the United States were virtually tied for the top spot.

Fig. 5 Spam distribution of .lukitus variant

Other new items observed in this variant include a change in the C&C’s URI from “/checkupdate.php” to “/imageload.cgi,” and it now uses ‘3’ as its affiliate ID. This affiliate has been observed distributing Locky through spam emails containing an attached compressed Javascript or VBS downloader since last year.

Solution

1. FortiMail blocks all spam emails.
2. FortiGuard Antivirus service detects Locky samples as W32/GenKryptik.APXF!tr.
3. FortiGuard Webfilter service blocks and tags all download URLs as malicious.
4. FortiSandbox rates the Locky samples as High Risk.

Conclusion

This is the first massive Locky campaign that we’ve seen in a few months. Combined with the release of a different variants just the week before, this is starting to look like an ominously familiar cycle.

FortiGuard Lion Team will keep everyone posted.

راه اندازی یک حمل جدید توسط بدافزار لوکی

-= FortiGuard Lion Team =-

IOC

Locky Hashes:
29fc7875aac4e84fc6b5f76c9bb51eba9bb19eb4398cba5505050809b0f88035
89b769aac22faff618eb51f3b7a5b1a81790018af53630fe65e57bdf7010e735
935f4544820aa478b093ad309f46d09d92a028f7bba606a0f8c8f53b8e1f9b7a
3429c9d44de9aa8c3241601c51dc96ee82fdb4f416bb41c7b64b9ae954dce0c0
faba6d095b4a250e1fa098d7c2f5a6a1a263c409e1c2c30eefad5cedcabdf9d0

C&C:
91.228.239.216
31.202.128.249
185.80.148.137
192.162.103.213
109.237.111.179
78.108.93.185
185.75.46.220
185.17.120.130