2016-12-20 - "OSIRIS" VARIANT LOCKY MALSPAM WITH EXCEL FILES CONTAINING MALICOUS MACROS

ASSOCIATED FILES:

NOTES:


I know the ransomware authors were thinking of "Loki" when they named it "Locky".  But this current pairing of Egyptian and Norse mythology doesn't sit well with me.

 


Shown above:  Chain of events for an infection from this malspam.

 

THE EMAILS

IP ADDRESSES OF BOTNET HOSTS SENDING THE MALSPAM:

 

SUBJECT LINE:

 

SPOOFED SENDING ADDRESSES:

 

 


Shown above:  Data from 20 Locky malspam examples (part 1 of 2).

 


Shown above:  Data from 20 Locky malspam examples (part 2 of 2).

 


Shown above:  An example of these emails.

 


Shown above:  An example of these attachments--Excel spreadsheets with malicious marcos.

 

TRAFFIC


Shown above:  An example of infection traffic by the Excel macro from one of the emails.

 

TRAFFIC GENERATED BY THE EXCEL SPREADSHEET MACROS RETRIEVING THE LOCKY BINARY:

 

POST-INFECTION CALLBACK FROM THE LOCKY SAMPLE:

 

TOR DOMAIN FROM THE DECRYPTION INSTRUCTIONS:

 

FILE HASHES

LOCKY DLL FILE:

 

EXCEL SPREADSHEET ATTACHMENTS FROM THE MALSPAM (SHA256 HASH - FILE NAME):

 

IMAGES


Shown above:  Screen shot from an infected Windows desktop.  Note the .osiris file extension.

 

FINAL NOTES

Once again, here are the associated archives:

ZIP files are password-protected with the standard password.  If you don't know it, look at the "about" page of this website.

Click here to return to the main page.