by Ventsislav Krastev | November 21, 2016 | 0 Comments file-encryption, Locky, malware, Windows

Threat Summary Aesir Locky .aesir Extension Locky Ransomware – More Information About It

The ransomware that is a mystery wrapped in an enigma inside a riddle for malware researchers has been released in yet another variant. The latest Locky ransomware does not cheat on its roots and uses the .aesir file extension – the name of the old Norse god Æsir, similar to its other iterations – .thor, .locky and .odin. The ransomware has significantly improved its distribution capabilities and can affect even a higher number of users than its previous version. Users who have been infected by this ransom virus, should not follow the instructions set as their wallpaper and not pay any ransom amount requested by cyber-criminals. Instead, we suggest you read this article to become familiar with Locky ransomware and learn how to remove it, backup your files and try to restore them for free.

Image Source:https://vignette3.wikia.nocookie.net

Threat Summary

Name	Aesir Locky
Type	Ransomware, File-Encryption Malware
Short Description	The Locky .aesir malware iteration encrypts users files and uses a strong combination of AES and RSA ciphers to encrypt the files on the compromised computer asking the user to pay ransom in Bitcoin to get them back.
Symptoms	The user infected by the Aesir Locky variant may witness ransom notes and “instructions” in a text file and as the typical Grey/Pink Locky wallpaper. Locky advertises it’s uniquely made decryptor for the specific infected machine on an online Tor-based web page linked in those instructions.
Distribution Method	Via an Exploit kit, Dll file attack, malicious JavaScript or a drive-by download of the malware itself in an obfuscated manner.
Detection Tool	See If Your System Has Been Affected by malware Download Malware Removal Tool
User Experience	Join our forum to Discuss Aesir Locky.
Data Recovery Tool	Windows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.

.aesir Extension Locky Ransomware – More Information About It

First, before encrypting the files, this iteration of the Locky virus has to cause the infection first. This is performed by using a combination of sophisticated tools that allow the malware to spread and infect without the user noticing.

.Aesir Ransomware – Distribution and Infection

The first method by which Locky ransomware’s Aesir variant was discovered was a spam message which contained a malicious e-mail attachment as a .zip archive, named “logs_{random-id}.zip”. The contents of the e-mail were the following:

“Dear {First Name},
We’ve been receiving spam mailout from your address recently. Contents and logging of such messages are in the attachment.
Please look into it and contact us.
Best Regards,
Edith Hancock
ISP Support Tel.: (840) 414-21-61”

Source:Twitter.com

After the user opens the zip file, he will discover a malicious .js JavaScript file which is with a completely random A-Z, 0-9 name, such as the following:

After the user opens the JavaScript file, the .aesir version of Locky malware connects to a C2 server from one of the many distribution sites of Locky:

After this, the malware downloads a .dll file, again with random names in the %Temp% folder, where more files can be dropped. Not only this, but the Aesir Locky malware also drops an “information.cgi” file in it’s POST traffic, most likely containing a variant of it’s ransom note.

Another scenario of infection by this iteration of Locky ransomware has been reported to be via the social media giant Facebook. Malware researcher Catalin Cimpanu has reported at Bleeping Computer that the Locky has begun to spread over spam messages of malicious .svg files sent directly to the user from suspicious accounts. Spam messages, like Photo_2311.svg being directly sent, are not photos, and users are warned not to open them, since they contain the notorious Nemucod downloader used with Nemucod ransomware and may infect your computer with Locky.

Locky .aesir Extension Ransomware – Post-Infection Activity

Similar to the previous .shit, Locky variant, this type of ransomware uses javascript files and may also use .hta files for the infection. After this infection is caused, the malware may begin to execute the encryption procedure.

This procedure alters the core structure of a given file, rendering it to be no longer openable and the AES (Advanced Encryption Standard) encryption algorithm may be applied to do so. Once this algorithm is applied, the file becomes no longer openable and it’s core code looks like the following example:

After the encryption itself, the encrypted files, which are audio files, videos, pictures, databases, documents and other widely used files appear in a non-icon form with changed names and the .aesir file extension:

After the encryption process has completed, the Aesir version of Locky changes the wallpaper with the same language as it has detected based on the installed Windows:

This wallpaper leads to a web-page of Locky Decryptor which requests from users to convert money in BitCoin and make a ransom payoff to download the tailor made for them decryptor:

Locky Aesir Ransomware – Conclusion, Remove, and Restore Files

As a bottom line, this variant of Locky has numerous developments when it comes to it’s spreading, now supporting the ability to infect via malicious browser extensions, Facebook .svg files and new malicious JavaScript. Until experts manage to come up with a solution for Locky ransomware, advises are to remove all the Locky variants from your computer:

.shit Locky Iteration(see link in article above).
.thor Locky virus.
.locky Ransomware.
.odin Locky iteration.
.zepto Variant of Locky.

To remove the .aesir Locky variant, we urge you to first backup all the encrypted files because the ransomware uses a combination of AES and RSA ciphers and has developed a unique key for each file and tampering directly with the virus may break the files indefinitely. This is why we recommend if you do not have the experience to follow the Automatic instructions for removal below.

Regarding file decryption, the only reason malware researchers haven’t broken locky so far is that the virus uses a custom programmed decryptor that corresponds to a unique key for each infection. This makes discovering a common decryptor a very difficult task. However, you may want to try and use our alternative solution methods in step “2. Restore files encrypted by Aesir Locky” below. They are not fully effective but they may help restore at least some of your files since the malware may not have deleted them fully.

Ventsislav Krastev

Ventsislav is a cybersecurity expert at SensorsTechForum since 2015. He has been researching, covering, helping victims with the latest malware infections plus testing and reviewing software and the newest tech developments. Having graduated Marketing as well, Ventsislav also has passion for learning new shifts and innovations in cybersecurity that become game changers. After studying Value Chain Management, Network Administration and Computer Administration of System Applications, he found his true calling within the cybersecrurity industry and is a strong believer in the education of every user towards online safety and security.

How to Remove Aesir Locky from Windows.

Step 1: Boot Your PC In Safe Mode to isolate and remove Aesir Locky

OFFER

Manual Removal Usually Takes Time and You Risk Damaging Your Files If Not Careful!

We Recommend To Scan Your PC with SpyHunter

Keep in mind, that SpyHunter’s scanner is only for malware detection. If SpyHunter detects malware on your PC, you will need to purchase SpyHunter's malware removal tool to remove the malware threats. Read our SpyHunter 5 review. Click on the corresponding links to check SpyHunter's EULA, Privacy Policy and Threat Assessment Criteria

1. Hold Windows key() + R

2. The "Run" Window will appear. In it, type "msconfig" and click OK.

3. Go to the "Boot" tab. There select "Safe Boot" and then click "Apply" and "OK".

Tip: Make sure to reverse those changes by unticking Safe Boot after that, because your system will always boot in Safe Boot from now on.

4. When prompted, click on "Restart" to go into Safe Mode.

5. You can recognise Safe Mode by the words written on the corners of your screen.

Step 2: Uninstall Aesir Locky and related software from Windows

Here is a method in few easy steps that should be able to uninstall most programs. No matter if you are using Windows 10, 8, 7, Vista or XP, those steps will get the job done. Dragging the program or its folder to the recycle bin can be a very bad decision. If you do that, bits and pieces of the program are left behind, and that can lead to unstable work of your PC, errors with the file type associations and other unpleasant activities. The proper way to get a program off your computer is to Uninstall it. To do that:

1. Hold the Windows Logo Button and "R" on your keyboard. A Pop-up window will appear.

2. In the field type in "appwiz.cpl" and press ENTER.

3. This will open a window with all the programs installed on the PC. Select the program that you want to remove, and press "Uninstall"

Follow the instructions above and you will successfully uninstall most programs.

Step 3: Clean any registries, created by Aesir Locky on your computer.

The usually targeted registries of Windows machines are the following:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce

You can access them by opening the Windows registry editor and deleting any values, created by Aesir Locky there. This can happen by following the steps underneath:

1. Open the Run Window again, type "regedit" and click OK.

2. When you open it, you can freely navigate to the Run and RunOnce keys, whose locations are shown above.

3. You can remove the value of the virus by right-clicking on it and removing it.

Tip: To find a virus-created value, you can right-click on it and click "Modify" to see which file it is set to run. If this is the virus file location, remove the value.

IMPORTANT!
Before starting "Step 4", please boot back into Normal mode, in case you are currently in Safe Mode.
This will enable you to install and use SpyHunter 5 successfully.

Step 4: Scan for Aesir Locky with SpyHunter Anti-Malware Tool

1. Click on the "Download" button to proceed to SpyHunter's download page.

Download

Malware Removal Tool

It is recommended to run a scan before purchasing the full version of the software to make sure that the current version of the malware can be detected by SpyHunter. Click on the corresponding links to check SpyHunter's EULA, Privacy Policy and Threat Assessment Criteria.

2. After you have installed SpyHunter, wait for it to update automatically.

3. After the update process has finished, click on the 'Malware/PC Scan' tab. A new window will appear. Click on 'Start Scan'.

4. After SpyHunter has finished scanning your PC for any files of the associated threat and found them, you can try to get them removed automatically and permanently by clicking on the 'Next' button.

If any threats have been removed, it is highly recommended to restart your PC.

Windows Mac OS X Google Chrome Mozilla Firefox Microsoft Edge Safari Internet Explorer Stop Push Pop-ups

Get rid of Aesir Locky from Mac OS X.

Step 1: Uninstall Aesir Locky and remove related files and objects

OFFER

Manual Removal Usually Takes Time and You Risk Damaging Your Files If Not Careful!

We Recommend To Scan Your Mac with SpyHunter for Mac

Keep in mind, that SpyHunter for Mac needs to purchased to remove the malware threats. Click on the corresponding links to check SpyHunter’s EULA and Privacy Policy

1. Hit the ⇧+⌘+U keys to open Utilities. Another way is to click on “Go” and then click “Utilities”, like the image below shows:

2. Find Activity Monitor and double-click it:

3. In the Activity Monitor look for any suspicious processes, belonging or related to Aesir Locky:

Tip: To quit a process completely, choose the “Force Quit” option.

4. Click on the "Go" button again, but this time select Applications. Another way is with the ⇧+⌘+A buttons.

5. In the Applications menu, look for any suspicious app or an app with a name, similar or identical to Aesir Locky. If you find it, right-click on the app and select “Move to Trash”.

6: Select Accounts, after which click on the Login Items preference. Your Mac will then show you a list of items that start automatically when you log in. Look for any suspicious apps identical or similar to Aesir Locky. Check the app you want to stop from running automatically and then select on the Minus (“-“) icon to hide it.

7: Remove any left-over files that might be related to this threat manually by following the sub-steps below:

Go to Finder.
In the search bar type the name of the app that you want to remove.
Above the search bar change the two drop down menus to “System Files” and “Are Included” so that you can see all of the files associated with the application you want to remove. Bear in mind that some of the files may not be related to the app so be very careful which files you delete.
If all of the files are related, hold the ⌘+A buttons to select them and then drive them to “Trash”.

In case you cannot remove Aesir Locky via Step 1 above:

In case you cannot find the virus files and objects in your Applications or other places we have shown above, you can manually look for them in the Libraries of your Mac. But before doing this, please read the disclaimer below:

Disclaimer! If you are about to tamper with Library files on Mac, be sure to know the name of the virus file, because if you delete the wrong file, it may cause irreversible damage to your MacOS. Continue on your own responsibility!

1: Click on "Go" and Then "Go to Folder" as shown underneath:

2: Type in "/Library/LauchAgents/" and click Ok:

3: Delete all of the virus files that have similar or the same name as Aesir Locky. If you believe there is no such file, do not delete anything.

You can repeat the same procedure with the following other Library directories:

→ ~/Library/LaunchAgents
/Library/LaunchDaemons

Tip: ~ is there on purpose, because it leads to more LaunchAgents.

Step 2: Scan for and remove Aesir Locky files from your Mac

When you are facing problems on your Mac as a result of unwanted scripts and programs such as Aesir Locky, the recommended way of eliminating the threat is by using an anti-malware program. SpyHunter for Mac offers advanced security features along with other modules that will improve your Mac’s security and protect it in the future.

Click the button below below to download SpyHunter for Mac and scan for Aesir Locky:

Download

SpyHunter for Mac

Windows Mac OS X Google Chrome Mozilla Firefox Microsoft Edge Safari Internet Explorer Stop Push Pop-ups

Remove Aesir Locky from Google Chrome.

Step 1: Start Google Chrome and open the drop menu

Step 2: Move the cursor over "Tools" and then from the extended menu choose "Extensions"

Step 3: From the opened "Extensions" menu locate the unwanted extension and click on its "Remove" button.

Step 4: After the extension is removed, restart Google Chrome by closing it from the red "X" button at the top right corner and start it again.

Windows Mac OS X Google Chrome Mozilla Firefox Microsoft Edge Safari Internet Explorer Stop Push Pop-ups

Erase Aesir Locky from Mozilla Firefox.

Step 1: Start Mozilla Firefox. Open the menu window

Step 2: Select the "Add-ons" icon from the menu.

Step 3: Select the unwanted extension and click "Remove"

Step 4: After the extension is removed, restart Mozilla Firefox by closing it from the red "X" button at the top right corner and start it again.

Windows Mac OS X Google Chrome Mozilla Firefox Microsoft Edge Safari Internet Explorer Stop Push Pop-ups

Uninstall Aesir Locky from Microsoft Edge.

Step 1: Start Edge browser.

Step 2: Open the drop menu by clicking on the icon at the top right corner.

Step 3: From the drop menu select "Extensions".

Step 4: Choose the suspected malicious extension you want to remove and then click on the gear icon.

Step 5: Remove the malicious extension by scrolling down and then clicking on Uninstall.

Windows Mac OS X Google Chrome Mozilla Firefox Microsoft Edge Safari Internet Explorer Stop Push Pop-ups

Remove Aesir Locky from Safari.

Step 1: Start the Safari app.

Step 2: After hovering your mouse cursor to the top of the screen, click on the Safari text to open its drop down menu.

Step 3: From the menu, click on "Preferences".

Step 4: After that, select the 'Extensions' Tab.

Step 5: Click once on the extension you want to remove.

Step 6: Click 'Uninstall'.

A pop-up window will appear asking for confirmation to uninstall the extension. Select 'Uninstall' again, and the Aesir Locky will be removed.

How to Reset Safari
IMPORTANT: Before resetting Safari make sure you back up all your saved passwords within the browser in case you forget them.

Start Safari and then click on the gear leaver icon.

Click the Reset Safari button and you will reset the browser.

Windows Mac OS X Google Chrome Mozilla Firefox Microsoft Edge Safari Internet Explorer Stop Push Pop-ups

Eliminate Aesir Locky from Internet Explorer.

Step 1: Start Internet Explorer.

Step 2: Click on the gear icon labeled 'Tools' to open the drop menu and select 'Manage Add-ons'

Step 3: In the 'Manage Add-ons' window.

Step 4: Select the extension you want to remove and then click 'Disable'. A pop-up window will appear to inform you that you are about to disable the selected extension, and some more add-ons might be disabled as well. Leave all the boxes checked, and click 'Disable'.

Step 5: After the unwanted extension has been removed, restart Internet Explorer by closing it from the red 'X' button located at the top right corner and start it again.