PowerWare ransomware masquerades as Locky variant

Security researchers at Unit 42, part of Palo Alto Networks, have discovered a new version of ransomware masquerading as the well-known Locky variant. However, the malware only partially encrypts files and is easy to remove.

The researchers write that the ransomware provides files with the ‘locky’ extension and also takes over the message in which Locky asks for ransom. By pretending to be a known type of ransomware, the criminals behind this variant hope that victims will still pay. According to Unit 42, the PowerWare variant has more often imitated other malware.

However, this form of ransomware only appears to encrypt the first 2048 bytes of files on the victim’s computer with 128-bit AES. In addition, the key for decryption is present in the source code of the malware. This makes it easy to reverse the infection. The researchers have put a tool online for that purpose.

The infection by PowerWare occurs via a .NET file that unpacks a Powershell script, which searches for files on the victim’s PC.

The warning that victims see