Worthy of note.
Improved scripts in .lnk files now deliver Kovter in addition to Locky
msft-mmpcmsft-mmpcFebruary 2, 20170
Cybercriminals are using a combination of improved script and well-maintained download sites to attempt installing Locky and Kovter on more computers.
A few months ago, we reported an email campaign distributing .lnk files with a malicious script that delivered Locky ransomware. Opening the malicious .lnk files executed a PowerShell script that performed a download routine. More recently, we have found a more complex version of the script, delivering more malware from more download sites.
This new script has no less than five different hardcoded domains from which it attempts to download the payload malware. In addition to Locky, this script also now downloads Kovter.
The script attempts to access a specific location in the domains by using a parameter. It does this for all domains, one by one, until it is able to successfully download its payload. If unsuccessful in the first pass, it uses another parameter and goes through the five domains again. It exits after a second pass and still no successful download.
The use of multiple domains and the technique of storing the rest of the URL as a parameter is a way to circumvent URL filtering solutions. All the script needs is one URL that is not blocked in order to successfully download malware.
On the other hand, the use of specific parameters means the cybercriminals have complete control of the domains, whether they are compromised websites or were set up specifically for this purpose. More importantly, we observed that the malicious websites are updated with new versions of the malware payload every day.
This setup gives cybercriminals behind these attacks a great level of flexibility. They have the option to update the malware payload pointed to by the URLs, change the URLs in the script, or do both to try and evade detection.
Note: Woody I will move this once you have decided how you want to do it OR you can.
Best Regards,
Crysta
--------------------------------------
1. Tower Totals: 2xSSD ~512GB, 2xHHD 20 TB, Memory 32GB
SSDs: 6xOS Partitions, 2xW8.1 Main & Test, 2x10.0 Test, Pro, x64
CPU i7 2600 K, SandyBridge/CougarPoint, 4 cores, 8 Threads, 3.4 GHz
Graphics Radeon RX 580, RX 580 ONLY Over Clocked
More perishable
2xMonitors Asus DVI, Sony 55" UHD TV HDMI
1. NUC 5i7 2cores, 4 Thread, Memory 8GB, 3.1 GHz, M2SSD 140GB
1xOS W8.1 Pro, NAS Dependent, Same Sony above.
-----------------
). Let me know by Email if you like. Woody has my Email address.
