Unit 42 has recently discovered a new variant of PowerWare, also known as PoshCoder, imitating the popular Locky ransomware family. PoshCoder has been encrypting files with PowerShell since 2014, and the new variant named PowerWare was reported in March 2016. The malware is responsible for encrypting files on a victim's machine and demanding a ransom via the Bitcoin cryptocurrency.

In addition to using the ‘.locky' filename extension on encrypted files, this PowerWare variant also uses the same ransom note as the Locky malware family. This is not the first time PowerWare has imitated other malware families, as earlier versions have been known to use the CryptoWall ransom note. Other instances of ransomware have also been known to borrow code from others, such as the TeslaCrypt ransomware family.

Unit 42 has written a Python script that will recursively seek out .locky files on a victim machine and restore them to their original state. The decrypter can be found here.

The following screenshot shows an example of the script running on an infected Windows machine.

It is our hope that this script will assist victims that have been affected by this variant of PowerWare.

While this sample may appear to be new, it is in fact a variant of the previously discovered PowerWare malware family. Unlike other variants, this sample purports to be the Locky malware family.

Palo Alto Networks customers are protected from this threat in the following ways:

• All domains and IP addresses associated with this malware are correctly flagged as malicious.
• All samples encountered within this campaign are correctly identified as malicious by WildFire.
• An AutoFocus tag exists for the tracking and identification of this malware family.