Symtrex Inc.

Cyber Security Specialist

Call - 866-431-8972 | Send an Email | Request a Quote
Visit Us On FacebookVisit Us On TwitterVisit Us On Linkedin

Profile

 [metaslider id=2951] … Read More

  • Home
  • Profile
    • Contact Us
    • Security News
    • White Papers
  • Services
    • Compliance Regulations
      • PCI DSS Suite of Products
      • HIPAA/Hitech
      • SOX – Sarbanes Oxley
      • DCID 6/3/NISPOM Chapter 8/JAFAN DoD
      • NERC/FERC
    • Industry Consulting and Implementation
      • Banking and Financial
      • Energy/Utilities
      • Healthcare
      • Retail/Hospitality
    • Security Assessment
  • Security Solutions
    • Sophos
    • Endpoint Security Solutions
      • Bitdefender Business Solutions
      • Sophos Endpoint Protection
    • Forensic Solution – Threat Hunter
    • Network Access Control
      • NetShield
        • NetShield
    • NGFW – UTM – Perimeter Security
      • Sophos Network Protection
    • Security Awareness Training
      • KnowBe4 – Security Awareness Training
      • Sophos Phish Threat
  • White Papers
    • Sophos Webinar Series
  • Security News
    • Blog
    • Sophos Webinar Series
  • Free Security Tools

How does Locky ransomware use DGA in its attacks?

2016/11/01 by admin

From SearchSecurity (TechTarget) Nick Lewis

Locky ransomware has borrowed features from Dridex malware, which focused on attacking banks. Expert Nick Lewis explains Locky’s techniques and how to detect it.

Security researchers say a new brand of ransomware called Locky has borrowed a technique from the Dridex banking malware. What is the Dridex malware technique and what elements of Locky make it different from other types of ransomware?

The Locky ransomware continues to improve its attack capabilities. Fortinet blogged about updates they identified in recent versions of the malware. Locky ransomware has incorporated a domain name generating algorithm to improve the resilience of the command-and-control (C&C) communications. Locky also incorporated an update to the C&C where the communications are minimally encrypted to prevent analysis over the network. Adding this functionality required significant efforts by the malware authors. Given how the malware is regularly updated with new functionality incorporating new attack techniques, this might suggest an experienced cybercriminal operation instead of low-skilled hackers.

The Locky ransomware appears to have borrowed the initial idea for the domain generation algorithm (DGA) from the Dridex malware. The DGA uses the infected machine’s year, month, day as well as seed values. This makes it possible to predict the domains Locky will register, and to sinkhole those domains in advance. Researchers at Forcepoint Security Labs analyzed an updated sample of the Locky ransomware that has a significantly improved DGA without the previous shortcomings.

Even though the Locky ransomware has incorporated functionality for DGA into the malware, it still has a backup IP address used for C&C of the botnet. The C&C encrypted communication was broken by Fortinet and could be detected over the network. Fortinet also released indicators of compromise for the C&C systems and indicators that a local computer should be checked to identify whether the system is infected, if the files had not yet been encrypted.

Filed Under: Advanced Persistent Threat, antivirus, CyberThreats, endpoint, Ransomware, Security News, Snoopwall, Sophos

Let us help answer any questions you may have

requestmoreinformation.fw

Security News and Updates

  • Was my information part of a breach?
  • Phishing and stolen credentials
  • Ransomware is the Biggest Threat for Small to Medium Businesses

RSS SecurityWeek

  • Google Suspends Chinese Shopping App Amid Security Concerns
  • Verosint Launches Account Fraud Detection and Prevention Platform
  • Ransomware Gang Publishes Data Allegedly Stolen From Maritime Firm Royal Dirkzwager

Contact

  • Contact Us

Request More Info

  • Request Quote

Site Map

  • Site Map

© Copyright 2016 Symtrex Inc. ; All Rights Reserved · Privacy Statement