W32/Locky.AZKQ!tr.ransom

Analysis

W32/Locky.AZKQ!tr.ransom is a detection for a Ransomware Locky trojan.
Below are some of its observed characteristics/behaviours:

• This infection may cause to drop any of the following file(s):
  
  • undefinedUserundefined\Desktop\asasin.html : This file will serve as ransom notes.
  • undefinedTempundefined\[Random].exe : This file is detected as W32/Locky.AZKQ!tr.ransom.
  • asasin-[XXXX].html : where X is any Hexadecimal character, this file is dropped all over the affected hosts drive and will serve as ransom notes.
  • undefinedUserundefined\Desktop\asasin.bmp : This file is a picture/image and will serve as ransom notes.


• This malware was known to be downloaded by VBS/Agent.E136!tr.


• This Ransomware also changes desktop background to ransom notes using undefinedUserundefined\Desktop\asasin.bmp.


• Affected files of this Ransomware will use the filenaming format XXXXXXXX-XXXX-XXXX-XXXXXXXX-XXXXXXXXXXXX.asasin, where X is any alphanumeric character.


• Below is an illustration of the malware's Ransom notes:
  

  Figure 1: Ransom notes.

  
  

  Figure 2: Ransom notes.

Recommended Action

• Make sure that your FortiGate/FortiClient system is using the latest AV database.
• Quarantine/delete files that are detected and replace infected files with clean backup copies.