2016-12-16 - "OSIRIS" VARIANT LOCKY RANSOMWARE FROM WORD DOCUMENTS WITH MACROS

NOTICE:

ASSOCIATED FILES:

NOTES:


Shown above:  Chain of events for an infection from this malspam.

 

THE EMAILS

IP ADDRESSES OF BOTNET HOSTS SENDING THE EMAILS:

 

SUBJECT LINES:

 

SPOOFED SENDING ADDRESSES:

 

RECIPIENT:

 


Shown above:  Data from 20 emails pushing Locky ransomware (part 1 of 2).

 


Shown above:  Data from 20 emails pushing Locky ransomware (part 2 of 2).

 


Shown above:  An example of these emails.

 


Shown above:  An example of these attachments--Word documents with malicious macros.

 

TRAFFIC


Shown above:  An example of infection traffic by the Word macro from one of the emails.

 

TRAFFIC GENERATED BY THE WORD DOCUMENT MACROS RETRIEVING THE LOCKY RANSOMWARE BINARY:

 

POST-INFECTION CALLBACK FROM THE LOCKY RANSOMWARE SAMPLE:

 

TOR DOMAIN FROM THE DECRYPTION INSTRUCTIONS:

 

FILE HASHES

LOCKY RANSOMWARE DLL FILE:

 

WORD DOCUMENT ATTACHMENTS FROM THE EMAILS (READ: SHA256 HASH - FILE NAME):

 

IMAGES


Shown above:  Screen shot from an infected Windows desktop.  Note the .osiris file extension.

 

Click here to return to the main page.