A new variant of an already devastating ransomware, Locky is back with different tactics of infection and advanced features. The ransomware is reported to affect users on a massive scale. The newer variant of the ransomware attacks users on a massive scale and infects their computers via a Nuclear Exploit Kit. Not only this, but the ransomware also can perform several other activities on the user PC such as defend itself and evade anti-malware software. All users who have been affected are strongly advised to remove this ransomware using instructions, such as the ones after this article.
|Short Description||Encrypts the user files with a combination of AES and RSA encryption algorhithms and demands ransom payment for the return of the files.|
|Symptoms||The user may witness changed wallpaper and a “HELP_instructions.txt” file to automatically open on startup.|
|Distribution Method||Via PUPs, installed by bundling (Browser Hijackers) or by visiting a suspicious third-party site that is advertising it.|
|Detection Tool||Download Malware Removal Tool, to See If Your System Has Been Affected by Locky|
|User Experience||Join our forum to discuss Locky.|
|Data Recovery Tool||Windows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.|
Locky 2.0 Ransomware Distribution
To be spread, this ransomware has been reported by CheckPoint malware researchers to use the Nuclear exploit kit. This is particularly effective method primarily because this kit uses several different targets to spread:
- Adobe Flash Player.
- Microsoft Silverlight.
- Adobe PDF.
- Internet Explorer Exploits.
The Nuclear exploit kit exists since the year 2009, and it is widely used and effective in dropping a payload of this and other malware on unsuspecting users’ computers.
Exploit Kit Attacks Grow in 2015 Q3; Patch Management is Crucial
Locky Ransomware 2.0 In Detail
Similar to the first variant of Locky Ransomware, the malware is dropped, looks for the same file extensions and uses the two very same primary encryption algorithms to lock the user files:
The combination of the algorithms makes the data impossible to be decrypted. The ransomware scans for the same file extensions such as the first variant, and after encryption changes the wallpaper with the following ransom message:
The differences and improvements that the newer variant of Locky possesses are the following:
- Using Nuclear Exploit Kit to infect more users successfully.
- Obfuscated its configuration file to make tracing the C&C centers of the cyber-crooks impossible.
- Shadow execution of its Payload in the shadow volume copies of Windows.
- New HTTP additions and patches that strengthen its communications and make it significantly more difficult to trace.
- A new included DGA algorithm to additionally strengthen the communication process with the cyber-criminals.
Conclusion and Removal
The bottom line for the newer variant of Locky ransomware is that it is reported to be even more effective by malware researchers. Given that Locky has had an immense impact on user PCs so far, the second variant of the ransomware may be equal or even better.
Regarding the removal of malicious files used by this Ransomware, it is good to know that the removal instructions remain the same. To remove it permanently without affecting your OS, it is strongly advised to use the steps illustrated below and then to make sure you employ a decent anti-malware software to protect you in the future.
If you want to decrypt your files, unfortunately, you should know that there is no relevant method for the direct decryption of the files. Researchers have not yet discovered any holes and exploits in the code of the malware because the configuration file has its data concealed. But you are welcome to try those mentioned above standard alternative methods for restoring your files.