The malware writers behind the Locky and Zepto ransomware projects proved once again that they are working all the time not only to infect more and more users and remain on top of the ransomware chart, but they are also working the infection procedure itself to make those attacks even more successful – using .DLL file injection.
This way, these cyber-criminals have improved the infection methods is that they focused on a very important “bottleneck” – the types of files that are used to conduct the encryption and the dropping of the malicious encryption and other support modules of the ransomware.
Why The New Infection Method?
Related Article: Locky, Dridex Botnet Has Also Delivered TeslaCrypt(More information about the Locky spam infections)
However, unlike the previously used executables, the hackers behind Locky ransomware have once yet made a change creating the possibility to run a .dll file via the process rundll32.exe. Since most antivirus products do not detect suspicious activities because they tend to set this process as a legitimate one and skip scanning it for malicious activities, the systems become infected with either Zepto or Locky, still encrypting files of victims.
How Does A DLL Infection Work?
To understand how this infection process works, we need to dissect what the rundll32.exe process exactly performs.
Originally the rundll32.exe is an application that is used to run the so-called Dynamic Link Library (DLL) files, because they have no way of being executed directly. This is one way and most likely the technique Locky or Zepto may use to successfully infect the computer of the victim. However, sometimes anti-malware programs catch suspicious activity and this is why, the virus uses the so-called process obfuscation, making the DLL file to skip the latest antivirus definitions. Such obfuscators also known as file cryptors are very expensive and their ability to remain unnoticed vanishes extremely fast, because most antivirus programs become updated very often.
Locky and Zepto Continue Their Campaigns Even More Vigorously