These files then generate unique decryption key.
osiris infects those files, the virus begins to replace the code of those files with custom symbols belonging to a very strong encryption algorithm, called AES-128. Files that have something In common with most virtual drive players.Files that are associated with Microsoft Word.This includes encrypting most often met file formats of: So far it is reported to be pre-configured in order to encrypt file types that are the same as the previous versions, like the. Once the user clicks on the file, obfuscated actions may immediately connect to one of the many Locky distribution websites:Īfter having connected to those webistes, the malware may download an obfuscated payload in crucial Windows folders, like the previously detected by Hybrid-Analysis a1.exe containing Locky, located in %Temp%.
osiris file extension has been reported to use a file, named as “Osiris.htm” or an “.xls” file with random numbers as a name.
rar archives that have similar or the same names as the attachments to avoid detection by e-mail providers’ security. These files are usually stored in archives such as. vbs (Visual Basic Script) that causes direct infection xls file with a random name such as _2234_214252_ The e-mails are reported to contain the following type of files that cause the infection: E-mail messages used by the creators of Locky are considered to be the primary threat to users. The creators of Locky ransomware have stuck to the well-known method of spreading the malware, using spam campaigns to replicate it via e-mail. This variant differs by most Locky ransomware variants mainly by some additions to the methods of distribution of the virus and the file extension, using an Egyptian god instead of the occasional Norse gods used in the previous versions of the malware. The virus is focused primarily on encrypting files of the victims’ computers after which leaving them with the. Other variant of the devastating Locky ransomware virus has been detected by malware researchers out in the open to demand the sum of 3 BTC as a ransom on infected computers.