Locky Ransomware (Lukitus) Support and Help Topic - Lukitus.html

I haven't seen anyone hit with this yet, but was advised about it by a security firm I'm in contact with. Seems to be copying off of CryptoWall 4.0's strategy of encrypting the filename, but adds ".locky" extension. The ransom note left is "_Locky_recover_instructions.txt". It does attempt to delete shadow copies from the VT analysis.
 
https://www.reddit.com/r/Malware/comments/45xkn9/any_info_on_locky_ransomware/

I have advised Grinler and the rest of Security Colleagues who specialize in crypto malware ransomware with a link to this topic.

I noticed with the encrypted filenames listed on VT, it is a 32 character string, but the first 16 characters are the same for all files. This could be an identifier for the victim perhaps. Hopefully that means it is a weaker encryption, at least for the filenames.

Yup, I saw this yesterday on reddit as well. Put up an article here:

The Locky Ransomware Encrypts Local Files and Unmapped Network Shares

Today, I got received several fake invoice emails with a .doc that looks to be .locky ransomware. I uploaded them to Malwr.com Cuckoo sandbox. This one generated a screenshot of a notepad file _Locky_recover_instructions.txt with payment instructions

 

Here's the link to the analysis: https://malwr.com/analysis/Y2RjOWE2YzUyODRhNDY4NmFkOGY2MDk1NzVkNTZkYmU/

already have encryption cases in the Russian segment with the encoder (Locky Ransomware), in particular http://forum.esetnod32.ru

 

Example of encrypted files:

https://www.sendspace.com/file/69wn0p

 

Locky registry branch

https://www.sendspace.com/file/4qlveo

Edited by al1963, 20 February 2016 - 01:02 AM.

Hi al1963, You can help me?.. this is the link... thanks..

https://www.sendspace.com/filegroup/8ZXEq3aY%2BCLgda3zvOGSzSZtEGXkPnaL

As noted by Grinler, the site owner of Bleeping Computer in this news article.

At this time, there is no known way to decrypt files encrypted by Locky.

 

This doesn't seem to be breakable except dumping their SQL database on the server.

We've found the following connection from an infected machine to a locky CNC server.

POST /main.php HTTP/1.1
Host: 91.121.97.170
Content-Length: 55
Connection: Keep-Alive
Cache-Control: no-cache

\xb7\x8e\x92\xf0\xc8\xf1\xf3[7\xa9\xbc\xc4M>\xf0\x13\xad\xfdz
\x00\xe6\xaa.&\xff_m\x8b'\xbce\xca\xc8>\xb1\x1f72\xed\xd0
{\xe8\x00q\xbb\x1a\x19\xa0\x85\x89\xe10\x0f

Who is able to break the URI of above? We would like to know what has been sent to the CNC server.

 

Thanks!

Nobody?

@razor92

 

You have to be patient, not everyone has the same timezone as you. Also, not everyone is hawk-eyed on every topic.

 

It looks like hex to me, so I ran that through a converter blindly, and it doesn't look all too helpful without further context.

·ŽðÈñó©¼Äð­ýæªÿ¼ÊȱríÐè» á

All I found was it pulled up a few samples of the Locky malware itself on Malwr when searching via Google. Afraid I don't know more about how to decipher what it could be at this point.

@razor92

 

You have to be patient, not everyone has the same timezone as you. Also, not everyone is hawk-eyed on every topic.

 

It looks like hex to me, so I ran that through a converter blindly, and it doesn't look all too helpful without further context.

·ŽðÈñó©¼Äð­ýæªÿ¼ÊȱríÐè» á

All I found was it pulled up a few samples of the Locky malware itself on Malwr when searching via Google. Afraid I don't know more about how to decipher what it could be at this point.

Yeah it's from Malwr. I uploaded the sample when it was FUD.

 

I hope there is someone who is able to "decrypt" the piece of code.

Unfortunately, at this time, there is no known way to decrypt files encrypted by Locky.

As with most ransomware infections...the best solution for dealing with encrypted data is to restore from backups. If that is not a viable option and if there is no fix tool, the only other alternative is to save your data as is and wait for a possible breakthrough...meaning, what seems like an impossibility at the moment (decryption of your data), there is always hope someday there may be a potential solution so save the encrypted data and wait until that time.

Grinler, (aka Lawrence Abrams), the site owner of Bleeping Computer has said this...

If you are affected by ransomware and do not plan on paying the ransom, the best bet it to immediately image the drive before doing anything else. Then in the future if there is a way to decrypt the files you have everything you may need to do so.