Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Power Ware Ransomware Spoofing Locky Malware Family

Summary: Unit 42 discovered a new PowerWare (PoshCoder) variant that encrypts files with PowerShell, appends the '.locky' extension, and drops a ransom note identical in wording to the Locky ransomware family. The sample is a .NET executable built with Quest Software's PowerGUI that unpacks an embedded fixed.ps1 script from Scripts.zip and runs it via PowerShell.exe, using AES-128 with a hard-coded key and encrypting only the first 2048 bytes of each targeted file.

What's compelling: Because the key is hard-coded and only the first 2048 bytes are encrypted, victims can decrypt without paying - but the borrowed Locky branding means an incident responder may misidentify the family and reach for the wrong tooling.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related