Sign In with your
Trend Micro Account
Need Help?
Need More Help?

Create a technical support case if you need further support.

Lukitus Ransomware Information

    • Updated:
    • 6 Sep 2017
    • Product/Version:
    • Deep Discovery Inspector 3.8
    • Deep Security 10.1
    • InterScan Messaging Security Virtual Appliance 9.1
    • OfficeScan XG.All
    • ScanMail for Exchange 12.All
    • Platform:
    • N/A N/A
Summary

THREAT INFORMATION

Lukitus Ransomware is a new variant of Locky Ransomware that encrypts user’s data and appends the [.]lukitus file extension. Lukitus Ransomware encrypts personal photos, videos, and documents of the victim and changes the names of the files into random characters and numbers, followed by the [.]lukitus file extension.

ARRIVAL AND INSTALLATION

Lukitus ransomware infection chain

Lukitus Ransomware infection chain

The infection chain of Lukitus Ransomware begins with a socially-engineered email that contains a malicious MS Office file or a ZIP/RAR attachment with embedded malicious JS/VBS scripts. It may also arrive as a spoof drop box notification email.

When the malicious file is executed, it connects to a URL hosting the main ransomware file (Lukitus) and downloads it. Then, it encrypts the files as well as the network shares on the machine. The main binary of the ransomware then self-destructs after executing its payload.

Encrypted files by Lukitus Ransomware

Encrypted files by Lukitus Ransomware

Lukitus Ransomware Ransom Notes

Lukitus Ransomware Ransom Notes

Details
Public

TREND MICRO PRODUCT SOLUTIONS

Below are the available Trend Micro product solutions for Lukitus/Locky Ransomware:

 
All related samples are detected by AS Full Pattern 3300.

Messaging products such as IMSVA and SMEX can block spam mails related to this ransomware. It checks for email reputation and web reputation of the embedded links, file attachments, as well as macros in MS Office documents.

Enabling the Ransomware Protection feature in InterScan Messaging Security Suite (IMSS) or InterScan Messaging Security Virtual Appliance (IMSVA)

Files related to this ransomware are detected as the following:

  • Downloaders (detected using OPR 13.603.00)
    • Mal_Cerber-JS03d
    • TROJ_FRS.0NA004I117
    • JS_NEMUCOD.TH822
    • JS_NEMUCOD.ELDSAUJM
  • Lukitus Ransomware (All samples are now detected using OPR 13.637.00)
    • Ransom_LOCKY.DLDTATN
    • Ransom_LOCKY.AJA
    • Ransom_LOCKY.TH817

    Detections were renamed from Ransom_CERBER.SMALY0.

Predictive Machine Learning is a powerful tool that helps protect your environment from unidentified threats and zero-day attacks. It performs a behavioral analysis on unknown or low-prevalence processes to determine if an emerging or unknown threat is attempting to infect your network.

Predictive Machine Learning detects Lukitus ransomware related files as the following:

  • Downloader.JS.TRX.XXJS447FF006K0001
  • Troj.Win32.TRX.XXPE002FF018

Predictive Machine Learning

Web Reputation Services evaluates the potential security risk of all requested URLs at the time of each HTTP request. Depending on the rating returned by the database and the security level configured, web reputation either blocks or approves the request.

Web Reputation service already blocks all of the known URLs associated with Lukitus ransomware.

Web Reputation

Behavior Monitoring can detect a specific sequence of events that may indicate a ransomware attack. Thus, Behavior monitoring detects and blocks the file encryption routine of Lukitus ransomware.

Behavior Monitoring

DDI is helpful in identifying the impacted machines on the network because it has the following detection rules for this ransomware:

  • Trend Micro URL Filtering Engine (TMUFE)
    • C&C Server URL in Web Reputation Services database - HTTP (Request)
    • Dangerous URL in Web Reputation Services database - HTTP (Request)
    • Ransomware URL in Web Reputation Services database - HTTP (Request)
  • Threat Detection Rules
    • LOCKY - Ransomware - HTTP (Request) - Variant 2 - Rule ID: 2116

    It was previously detected by the following rules:

    • CERBER – Ransomware - HTTP (Response or Request) - Rule ID: 2359 and 2338
    • CERBER - Ransomware - UDP - Rule ID 2071

Threat Description

Deep Security has an IPS solution that can help detect and block Locky Ransomware-associated network traffic.

IPS rules

Instructions on how to enable this feature can be viewed from this link: Ransomware Detection and Prevention in Deep Security.

Tipping point has the following ThreatDV to block and prevent threat activity related to Lukitus Ransomware:

  • 26222: HTTP: Locky CnC checkin Nov 21
  • 26223: HTTP: Locky CnC checkin Nov 21 M2
  • 26227: HTTP: Locky CnC Checkin HTTP Pattern

Filter Criteria

BEST PRACTICES FOR IT ADMIN

  • Optimize email security. Blocking malicious emails at the gateway level before they can even reach the users will help prevent malware infections.
  • Review the need for VBS and JS scripting in the machine. If it is not needed, you can disable it to reduce the risk of malware infection.
  • Enable file extension in Windows. The default Windows setting has file extensions disabled. This means that you have to rely on the file thumbnail to identify it. Enabling extensions makes it much easier to identify file types that are not commonly sent, such as JavaScript or VBScript.
  • Don’t enable macros in MS Office file attachments received via email.
  • Restrict write permissions on the file server if possible. Ransomware encrypts files for both local and network shares with write permissions.
  • Back up files. Cybercriminals use the potential loss of important and personal data as a fear-mongering tactic to coerce victims into paying the ransom. Organizations and end users can back up files to remove their leverage. Keep at least three copies, with two stored in different devices, and another in an offsite or safe location.
  • Do Patch Management. It is highly recommended to keep application patch levels up-to-date as a lot of malware use these vulnerabilities to compromise your machine. Examples of critical applications are Java, Adobe, and your Internet Browser.
  • Educate users about social engineering attacks. Getting infected by Ransomware is an indication that the user is not security aware. The user may receive spam mail and open the attachment without knowing the risks involved.
Premium
Internal
Rating:
Category:
Troubleshoot; Remove a Malware / Virus
Solution Id:
1118188
Feedback
Did this article help you?

Thank you for your feedback!

To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.

If you need additional help, you may try to contact the support team. Contact Support


To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.