App Review Locky Ransomware new adds the .aesir extension - Demonstration of attack

[GrujaRS]

Changes the file name and adds the extension .aesir

 

[Der.Reisende]

Nice demonstration as always, thank you for sharing @CyberSecurity GrujaRS!
Already came across at least one today (thank you @Daniel Hidalgo for the nice pack of today).
Don't trust your AV too much, if it does not have a signature, and mechanics don't work out, you might be wasted. A**** Pro did not really recognize the threat (not a single warning), encryption is super fast.
P.S. Someone's really a fan of northern mythology, isn't (s)he?

 

[DardiM]

Thanks for your video

Antivirus scan for 7d8f69106ca48bd9c3946487e9c0bce95347a6705487b23bc2df7e3d51469ba0 at 2016-11-21 09:44:35 UTC - VirusTotal
https://www.hybrid-analysis.com/sam...6705487b23bc2df7e3d51469ba0?environmentId=100

 

[dreyfus]

Hi,
new here, searching for some help in a situation like this. Network folder all the files are .aesir.
What can I do?

 

[MalwareBlockerYT]

Thanks for the demonstration. I need to do a video on this but the last time I tried to execute Locky it didn't actually do anything... It changed from the .exe to svchost.exe but then didn't encrypt my files - it probably detected the VM.

 

[GrujaRS]

Thanks for the demonstration. I need to do a video on this but the last time I tried to execute Locky it didn't actually do anything... It changed from the .exe to svchost.exe but then didn't encrypt my files - it probably detected the VM.

https://www.hybrid-analysis.com/sam...6705487b23bc2df7e3d51469ba0?environmentId=100
Sample JSE - JScript Encoded Script File
Greeting

 

[Dirk41]

Hi,
new here, searching for some help in a situation like this. Network folder all the files are .aesir.
What can I do?

Open a thread in malware removal assistance . Only @TwinHeadedEagle can assist you

 

[TwinHeadedEagle]

I can't help with this one, there is no way to decrypt files.