Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Ransomware: Locky, Tesla Crypt, Other Malware Families Use New Tool To Evade Detection

Summary: Unit 42 identified a new packing tool used by the Locky ransomware family to evade detection, with samples showing obfuscated API calls, decoy import tables, and self-modifying code that walks the PEB to locate kernel32.dll and jump to VirtualAlloc. The same technique was also found in TeslaCrypt and Andromeda samples dating back to March 14, 2016, and Palo Alto Networks says its WildFire service detects the packing technique and each family after unpacking.

Key Takeaway: The packer's red herrings - unused import tables, bogus LoadLibraryA calls, and noise instructions - are built specifically to defeat the static analysis and import hashing many detection stacks still rely on, so a signature that never fires is the difference between catching Locky and missing it.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Detection & Response
Related
YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026