4

During discussions about possible actions to mitigate the risk of the ransomware Locky, someone pointed at the possibility of preventing at OS level the creation of .locky files via the File Server Resource Manager. The idea was that the impossibility to create .locky files could hamper the execution malware.

Since I am extremely skeptical about the efficiency of this technique I would like to understand the methodology used by Locky when dealing with targeted files.

I am not interested about how the encryption is done but rather what are the steps leading from a sane file to the encrypted version (specifically: what happens when Locky fails to encrypt a file and what happens to a file after its content have been (successfully or not) encrypted).

Is such an analysis available?

2
  • blog.avast.com/a-closer-look-at-the-locky-ransomware Above resolve your query, Regards, Riyas.
    – user104637
    Mar 16, 2016 at 15:53
  • @riyas: thank you, this is an informative article but it does not explain what happens with the files during the encryption in the context of the suggested mitigation
    – WoJ
    Mar 17, 2016 at 15:02

1 Answer 1

1

What happens when Locky fails to encrypt a file? Locky "fails" the encryption when it cannot reach one of the C&C server. It tries to receive the private key which is located on the C&C server. Locky cannot fail encryption once it has the private key, unless all the Locky-processes will be canceled while it's encrypting. This means that there is a big chance that a file could become corrupted.

What happens to a file after its content have been (successfully or not) encrypted? The content of an encrypted file will be all scrambled. This size of the file will be different and the entropy will also be higher. The content of a failed encrypted file will be probably the same. Except it can be that the content will be smaller than the original content of the unencrypted file. And once you decrypt it with the private key, the file will be most likely be corrupted.

4
  • The failure can also be due to the fact that the write process of the encrypted file fails (for a reason or another). As for the content of the original file - I was wondering whether it is securely deleted or something along these lines. The fact that the file is "overwritten" usually means that a new encrypted file was created, filled with (encrypted) data and the original one was deleted (which may be done in various ways)
    – WoJ
    Mar 16, 2016 at 13:16
  • This is/was a common way for ransomware, but with Locky it changes the filename. It uses the random generated ID to identify the infected computer, a unique ID for the file and the locky-extension. So it's like [pc id][file id].locky. Locky doesnt create any new files and delete the old ones, it only encrypts the existing file. Mar 16, 2016 at 13:35
  • The point is that that I do not know what "only encrypts the existing file" means. If it renames the file, then opens it for write - the encryption would fail with the right FSRM settings.
    – WoJ
    Mar 17, 2016 at 15:05
  • Not sure if FSRM is tested against the locky ransomware. But in theory it would work, but only for the ransomware with prefixed extensions like locky. Also I'm not sure if it first change the filename and then the content, or the other way around. If it's the first way, FSRM should be able to prevent Locky (in theory). But the only way to be sure of the answer, is to test it yourself. Mar 17, 2016 at 16:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .