Malware News Locky Adds Support for a New "S**T" Extension

[Jack]

Security researcher MalwareHunterTeam tells Softpedia that the infamous Locky ransomware has returned today with a new spam campaign that's spreading a new version of the ransomware.

Last week, Microsoft's Malware Protection Center had revealed that the group behind Locky had reduced its spam efforts and was testing a new distribution method that relied on small spam campaigns spreading booby-trapped LNK (shortcut) files.

Over the weekend, Locky's creators have returned to their old tricks, and are in the midst of a massive spam campaign that spread zipped HTA, WSF, and JS files, which are Locky's classic infection methods. An analysis of the email lures used for this spam campaign is available via My Online Security.

Locky pushes out new file encryption extension
The most visible change in this version of Locky is the extension it appends at the end of encrypted files.

The new extension is #####, and this is not the only thing salacious detail observed by researchers, who say the ransomware calls back home, to a server file named "linuxsucks.php."

For example, a file named photo.png would become [random_characters].#####. Previously Locky had used extensions such as LOCKY, ZEPTO, and ODIN.

As for the random file names, MalwareHunterTeam said the format is "8-4-4-4-12.#####, where the first 8-4-4 characters are unique for infection, and the last 4-12 is unique for the file."

Read more: Locky Adds Support for a New "S**T" Extension

Related: Video Review - Locky Ransomware adds a extension .#####!Demonstration of attack video review.

 

[LabZero]

Well, the new extension name is really spot on.

 

[_CyberGhosT_]

Its ok Jack, you can say .#####

 

[LabZero]

Its ok Jack, you can say .#####

Just for educational purpose

 

[_CyberGhosT_]

The lil bastage does not like Linux, prob tried writing one for Linux and failed
Bill Gates software is much easier to smash

 

[LabZero]

The lil bastage does not like Linux, prob tried writing one for Linux and failed
Bill Gates software is much easier to smash

It is common opinion that malware, in general, hits the most popular operating systems.
I say that the malware affects those more fragile!

 

[SHvFl]

The lil bastage does not like Linux, prob tried writing one for Linux and failed
Bill Gates software is much easier to smash

Lol this is actually not true at all. Sure in theory and the way Linux works makes it a bit harder to abuse but trust me if we all used Linux malware coders would have smashed them as easily as they do with windows.
The awesome and also sad part of malware is that the fight never stops. It's like in Tango, you need 2 to dance.

 

[_CyberGhosT_]

Lol this is actually not true at all. Sure in theory and the way Linux works makes it a bit harder to abuse but trust me if we all used Linux malware coders would have smashed them as easily as they do with windows.
The awesome and also sad part of malware is that the fight never stops. It's like in Tango, you need 2 to dance.

I was being funny, but there are so many variants that it would not be so easy with Linux, and they are not
afraid to change some coding if needed, unlike MicroSoft.

 

[SHvFl]

I was being funny, but there are so many variants that it would not be so easy with Linux, and they are not
afraid to change some coding if needed, unlike MicroSoft.

If they had users in billion they would also be afraid. It's ok to do whatever you want when you only have a limited base which you know they are loyal. A change in windows security might break so make applications that half the users will not update.
Sure they can improve and they are doing it slowly but software security companies need to also eat.

 

[DardiM]

Thanks for the share

=> I have seen some script-based downloaders that download this sample, on the Malware Vault : when I saw the "words" I asked to myself "if I make an analyse and post it, should I change these pars", hahaha

 

[jamescv7]

Still same behavior + continuously improving the product + new way to insult through file extension = an innocent Ransomware.

 

[soccer97]

The name of that extension may be the inadvertent first word coming out of people's mouth when they see all their files are encrypted.

The fact that it is referred to as .ODIN makes me wonder if it is going to be attacking or is planning to infect people downloading these Firmware flashing tools for their Android - and I think they may use them when trying to unroot their devices. Hopefully its an anomaly.