Locky Ransomware Installed Through Nuclear EK
Unit 42 reports Locky ransomware delivered through the Nuclear exploit kit using Flash exploits, adding a drive-by path to existing malspam distribution.
Unit 42 observed Locky ransomware being delivered by the Nuclear exploit kit in March 2016 via Flash exploits, following February reports of Neutrino EK distributing Locky. Infections follow a drive-by chain through a gate to the Nuclear EK, which either installs Locky directly or drops a downloader that retrieves it from another domain. Locky retains two distribution paths: malspam with malicious Office macros or JavaScript attachments and exploit kit traffic triggered by casual web browsing.
- Nuclear EK Flash exploits deliver Locky directly or via a downloader payload
- Earlier February 2016 reporting documented Neutrino EK spreading Locky
- Locky spreads via two paths: malspam attachments and exploit kit drive-by traffic
- Post-infection traffic contacts multiple IP addresses for follow-up activity
- ATT&CK
- T1189 Drive-by CompromiseT1203 Exploitation for Client ExecutionT1486 Data Encrypted for Impact
- Vendors
- Palo Alto NetworksProofpoint
- Malware
- LockyNuclear EKNeutrino EK
- Organizations
- Palo Alto NetworksProofpoint
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | lotos.castrumtelcom.com.br | .np Nuclear EK IP address: 46.101.8.169 Nuclear EK domains: lotos.castrumtelcom.com.br , here.jninmobilaria.com.ar Follow-up malware IP address: 4 |
| ipv4 | 149.202.109.205 | Locky ransomware: 51.254.181.122 51.255.107.8 78.40.108.39 149.202.109.205 Exploits and malware noted: Description: 2016-03-15 Nuclear |
| ipv4 | 46.101.8.169 | Gate domain: sed.poudelkamal.com.np Nuclear EK IP address: 46.101.8.169 Nuclear EK domains: lotos.castrumtelcom.com.br , here.jninm |
| ipv4 | 46.148.20.32 | r , here.jninmobilaria.com.ar Follow-up malware IP address: 46.148.20.32 Follow-up malware domain: js.cefora.com.ar IP addresses fro |
| ipv4 | 51.254.181.122 | ses from post-infection traffic caused by Locky ransomware: 51.254.181.122 51.255.107.8 78.40.108.39 149.202.109.205 Exploits and malw |
| ipv4 | 51.255.107.8 | nfection traffic caused by Locky ransomware: 51.254.181.122 51.255.107.8 78.40.108.39 149.202.109.205 Exploits and malware noted: De |
| ipv4 | 78.40.108.39 | fic caused by Locky ransomware: 51.254.181.122 51.255.107.8 78.40.108.39 149.202.109.205 Exploits and malware noted: Description: 20 |
| ipv4 | 91.195.12.177 | Date/time range: 2016-03-15 and 2016-03-16 Gate IP address: 91.195.12.177 Gate domain: sed.poudelkamal.com.np Nuclear EK IP address: |
| sha256 | 4228036684f4f519704a102cd9322ac9edb1bfb5b20558a7a6873818f0e6a7b4 | scription: 2016-03-16 Nuclear EK Flash exploit SHA256 hash: 4228036684f4f519704a102cd9322ac9edb1bfb5b20558a7a6873818f0e6a7b4 Description: 2016-03-15 Nuclear EK payload - Locky ransomwa |
| sha256 | 94bd74514cc9e579edf55dd1bac653ceca1837d930d109c6e701afe309b23310 | scription: 2016-03-15 Nuclear EK Flash exploit SHA256 hash: 94bd74514cc9e579edf55dd1bac653ceca1837d930d109c6e701afe309b23310 Description: 2016-03-16 Nuclear EK Flash exploit SHA256 has |
| sha256 | a9dac0a0389c463b063cb30f647b3d1610e6052570efe2dfb1fca749d8f039fc | ayload - file that downloaded Locky ransomware SHA256 hash: a9dac0a0389c463b063cb30f647b3d1610e6052570efe2dfb1fca749d8f039fc Description: Locky ransomware downloaded by Nuclear EK payl |
| sha256 | cc2355cc6d265cd90b71282980abcf0a7f3dcb3a608a5c98e7697598696481af | re downloaded by Nuclear EK payload (soft.exe) SHA256 hash: cc2355cc6d265cd90b71282980abcf0a7f3dcb3a608a5c98e7697598696481af |
| sha256 | faf4f689683f3347738ef0a8370a78d504b513d44f3a70f833c50de3d138c3b2 | 16-03-15 Nuclear EK payload - Locky ransomware SHA256 hash: faf4f689683f3347738ef0a8370a78d504b513d44f3a70f833c50de3d138c3b2 Description: 2016-03-16 Nuclear EK payload - file that down |
From the original article
2 min read at unit42.paloaltonetworks.comIn February 2016, Unit 42 published detailed analysis of Locky ransomware . We certainly weren’t the only ones who saw this malware, and many others have also reported on it. Since that time, Locky has been frequently noted in various campaigns using malicious spam (malspam) to spread this relatively new strain of ransomware.
By Brad Duncan · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.