It has just been a week since the variation of Locky named Diablo6 appeared. Now it has launched another campaign more massive than the previous. This time, it uses “.lukitus”, which means “locking” in Finnish, as the extension for the encrypted files. The FortiGuard Lion Team was the first to discover this variant with the help of Fortinet’s advanced  Kadena Threat Intelligence System (KTIS) (1)

Fig. 1 Encrypted files with .lukitus extension

Fig. 2 Familiar Locky ransom note

Same Locky, More Spam

This new campaign has launched over four times the number of email samples, we have collected from different sources, compared to the previously discovered .diablo6 campaign.

Fig. 3 Spam campaign emails of .lukitus variant

This campaign uses the following email subjects and attachment names:

As in the previous campaign, the spam emails distributed in this campaign include an attached archive file (zip or rar) that contains a malicious Javascript or VBS script. Once opened, this attachment downloads the Locky payload. The following screenshot taken from KTIS summarizes this attack chain.

Fig. 4 Infection chain of .lukitus variant

In addition, the attack chain shows that some of the compromised download sites used in the previous campaign are still active, and arenow  being used to host this new variant.

Interestingly enough, this campaign seems to have been distributed mostly to Austria. In the previous campaign, Austria and the United States were virtually tied for the top spot.

Fig. 5 Spam distribution of .lukitus variant

Other new items observed in this variant include a change in the C&C’s URI from “/checkupdate.php” to “/imageload.cgi,” and it now uses ‘3’ as its affiliate ID. This affiliate has been observed distributing Locky through spam emails containing an attached compressed Javascript or VBS downloader since last year.

Solution

1. FortiMail blocks all spam emails.
2. FortiGuard Antivirus service detects Locky samples as W32/GenKryptik.APXF!tr.
3. FortiGuard Webfilter service blocks and tags all download URLs as malicious.
4. FortiSandbox rates the Locky samples as High Risk.

Conclusion

This is the first massive Locky campaign that we’ve seen in a few months. Combined with the release of a different variants just the week before, this is starting to look like an ominously familiar cycle.

FortiGuard Lion Team will keep everyone posted.

-= FortiGuard Lion Team =-

IOC

  Locky Hashes:  29fc7875aac4e84fc6b5f76c9bb51eba9bb19eb4398cba5505050809b0f88035  89b769aac22faff618eb51f3b7a5b1a81790018af53630fe65e57bdf7010e735  935f4544820aa478b093ad309f46d09d92a028f7bba606a0f8c8f53b8e1f9b7a  3429c9d44de9aa8c3241601c51dc96ee82fdb4f416bb41c7b64b9ae954dce0c0  faba6d095b4a250e1fa098d7c2f5a6a1a263c409e1c2c30eefad5cedcabdf9d0  

  C&C:  91.228.239.216  31.202.128.249  185.80.148.137  192.162.103.213  109.237.111.179  78.108.93.185  185.75.46.220  185.17.120.130  

https://github.com/fortiguard-lion/LockyIOCs/blob/master/Locky_Lukitus_IOC.txt