Trojan-Downloader:JS/Locky is ransomware that encrypts files saved on the machine and demands payment of a ransom in order to obtain the decryption key needed to restore normal access to the affected files.
F-Secure detects ransomware using a variety of signature and generic detections. Once detected, the F-Secure security product will automatically disinfect the suspect file by either deleting it or renaming it.
If the ransomware uses encryption to take files or an entire system hostage, the encryption may be sufficient to make it very difficult to decrypt the files without the necessary decryption key.
In such circumstances, the recommended course of action is to report the crime to the relevant authorities and restore the affected data from a recent clean backup.
Users typically encounter Locky ransomware by either being exposed to an exploit kit or via a spam email message with a file attachment.
Delivery via email
The most common way Locky ransomware is distributed is as a file attached to a email message. The emails may appropriate the names and/or branding of various legitimate companies to appear authentic. They will typically appear to be related to invoices, court orders or logistic/baggage related topics.
Delivery via exploit kit
Locky ransomware can also be delivered as the payload of an exploit kit. If the user is exposed to a exploit kit (usually by visiting a compromised website, or by being redirected to a malicious one) and it successfully exploits the user's machine, the kit will download the ransomware and it will immediately run.
Locky ransomware encrypt files stored on the machine. Depending on the specific variant, the encryption can be done using either the AES 128-bit or RSA 2048-bit encryption algorithms - which are extremely difficult to break.
Once the files are encrypted, a text file containing the ransom demand is saved on the system. In some variants, the desktop background is also changed to display the demand. The file will provide instructions on how to pay the ransom demanded.