During discussions about possible actions to mitigate the risk of the ransomware Locky, someone pointed at the possibility of preventing at OS level the creation of .locky files via the File Server Resource Manager. The idea was that the impossibility to create .locky files could hamper the execution malware.

Since I am extremely skeptical about the efficiency of this technique I would like to understand the methodology used by Locky when dealing with targeted files.

I am not interested about how the encryption is done but rather what are the steps leading from a sane file to the encrypted version (specifically: what happens when Locky fails to encrypt a file and what happens to a file after its content have been (successfully or not) encrypted).

Is such an analysis available?

  • blog.avast.com/a-closer-look-at-the-locky-ransomware Above resolve your query, Regards, Riyas. – user104637 Mar 16 '16 at 15:53
  • @riyas: thank you, this is an informative article but it does not explain what happens with the files during the encryption in the context of the suggested mitigation – WoJ Mar 17 '16 at 15:02

What happens when Locky fails to encrypt a file? Locky "fails" the encryption when it cannot reach one of the C&C server. It tries to receive the private key which is located on the C&C server. Locky cannot fail encryption once it has the private key, unless all the Locky-processes will be canceled while it's encrypting. This means that there is a big chance that a file could become corrupted.

What happens to a file after its content have been (successfully or not) encrypted? The content of an encrypted file will be all scrambled. This size of the file will be different and the entropy will also be higher. The content of a failed encrypted file will be probably the same. Except it can be that the content will be smaller than the original content of the unencrypted file. And once you decrypt it with the private key, the file will be most likely be corrupted.

  • The failure can also be due to the fact that the write process of the encrypted file fails (for a reason or another). As for the content of the original file - I was wondering whether it is securely deleted or something along these lines. The fact that the file is "overwritten" usually means that a new encrypted file was created, filled with (encrypted) data and the original one was deleted (which may be done in various ways) – WoJ Mar 16 '16 at 13:16
  • This is/was a common way for ransomware, but with Locky it changes the filename. It uses the random generated ID to identify the infected computer, a unique ID for the file and the locky-extension. So it's like [pc id][file id].locky. Locky doesnt create any new files and delete the old ones, it only encrypts the existing file. – mike-stokkel Mar 16 '16 at 13:35
  • The point is that that I do not know what "only encrypts the existing file" means. If it renames the file, then opens it for write - the encryption would fail with the right FSRM settings. – WoJ Mar 17 '16 at 15:05
  • Not sure if FSRM is tested against the locky ransomware. But in theory it would work, but only for the ransomware with prefixed extensions like locky. Also I'm not sure if it first change the filename and then the content, or the other way around. If it's the first way, FSRM should be able to prevent Locky (in theory). But the only way to be sure of the answer, is to test it yourself. – mike-stokkel Mar 17 '16 at 16:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.