20/04/2016
Locky ransomware removal instructions
What is Locky?
Locky is ransomware distributed via malicious .doc files attached to spam email messages. Each word document contains scrambled text, which appear to be macros. When users enables macro settings in the Word program, an executable file (the ransomware) is downloaded. Various files are then encrypted. Note that Locky changes all file names to a unique 16 letter and digit combination with a .locky file extension. Thus, it becomes virtually impossible to identify the original files. All are encrypted using the RSA-2048 and AES-1024 algorithm and, therefore, a private key (which is stored on remote servers controlled by cyber criminals) is required for decryption. To decrypt the files, victims must pay a ransom.
After the files are encrypted, Locky creates an additional .txt file in each folder containing the encrypted files. Furthermore, this ransomware changes the desktop wallpaper. Both text files and wallpaper contain the same message that informs users about the encryption. It states that files can only be decrypted using a decrypter developed by cyber criminals, which costs .5 BitCoin (at time of research, .5 BTC was equivalent to $207.63). To proceeds, the victim must install the Tor browser and follow the link provided in the text files/wallpaper. The website contains step-by-step payment instructions. Locky deletes all file shadow volume copies. At time of writing, there were no tools capable of decrypting files affected by Locky - the only solution to this problem is to restore your files from a backup.
Locky decrypt instructions
Research results show that there are hundreds of ransomware-type malware similar or identical to Locky including, for instance, Cryptowall, JobCrypter, UmbreCrypt, TeslaCrypt, and DMA-Locker. All have identical behavior - they encrypt files and demand a ransom. The only difference is the size of ransom and type of algorithm used to encrypt the files. Research also shows that there is no guarantee that your files will ever be decrypted even after paying the ransom. By paying, you simply support cyber criminals' malicious businesses. For this reason, you should never pay the ransom or attempt to contact them. Be aware also that malware such as Locky is usually distributed via fake software updates, P2P networks, malicious email attachments, and trojans. Therefore, it is very important to keep your installed software up-to-date and to double check what you are downloading. Be cautious when opening email attachments sent from suspicious addresses and use a legitimate anti-spyware or anti-virus suite.
Below is a screenshot of an email messages used for Locky ransomware distribution.
For example - email subject - "ATTN: Invoice J-12345678”, infected attachment - "invoice_J-12345678.doc" (contains macros that download and install the Locky ransomware on the victim’s computer):
File types targeted by Locky ransomware:
mid, .wma, .flv, .mkv, .mov, .avi, .asf, .mpeg, .vob, .mpg, .wmv, .fla, .swf, .wav, .qcow2, .vdi, .vmdk, .vmx, .gpg, .aes, .ARC, .PAQ, .tar.bz2, .tbk, .bak, .tar, .tgz, .rar, .zip, .djv, .djvu, .svg, .bmp, .png, .gif, .raw, .cgm, .jpeg, .jpg, .tif, .tiff, .NEF, .psd, .cmd, .bat, .class, .jar, .java, .asp, .brd, .sch, .dch, .dip, .vbs, .asm, .pas, .cpp, .php, .ldf, .mdf, .ibd, .MYI, .MYD, .frm, .odb, .dbf, .mdb, .sql, .SQLITEDB, .SQLITE3, .asc, .lay6, .lay, .ms11 (Security copy), .sldm, .sldx, .ppsm, .ppsx, .ppam, .docb, .mml, .sxm, .otg, .odg, .uop, .potx, .potm, .pptx, .pptm, .std, .sxd, .pot, .pps, .sti, .sxi, .otp, .odp, .wks, .xltx, .xltm, .xlsx, .xlsm, .xlsb, .slk, .xlw, .xlt, .xlm, .xlc, .dif, .stc, .sxc, .ots, .ods, .hwp, .dotm, .dotx, .docm, .docx, .DOT, .max, .xml, .txt, .CSV, .uot, .RTF, .pdf, .XLS, .PPT, .stw, .sxw, .ott, .odt, .DOC, .pem, .csr, .crt, .key, wallet.dat
https://www.pcrisk.com/removal-guides/9807-locky-ransomware
Locky Ransomware
Locky Ransomware Also Known As: .locky virusType: RansomwareDistribution: High Damage level: Written by Tomas Meskauskas on Saturday, 02 April 2016 04:44 AM Locky ransomware removal instructions What is Locky? Locky is…
pcrisk.com
Locky Ransomware Also Known As: .locky virusType: RansomwareDistribution: High Damage level: Written by Tomas Meskauskas on Saturday, 02 April 2016 04:44 AM Locky ransomware removal instructions What is Locky? Locky is ransomware distributed via malicious .doc files attached to spam email messages.…