View source for Trojan downloaders on the rise: don’t let Locky or TeslaCrypt ruin your day

{{Publication
|Botnet=Nemucod, TeslaCrypt, Locky,
|Vector=Nemucod,
|Group=Cryptolocker,
|Year=2016
|Date=2016-03-18
|Editor=ESET Welivesecurity
|Link=http://www.welivesecurity.com/2016/03/18/trojan-downloaders-rise-dont-let-locky-teslacrypt-ruin-day/
|Author=Josep Albors,
|Type=Blogpost
|Abstract=Win32/Filecoder.Locky.A is a ransomware variant that encrypts files with over 100 file types such as images, videos, databases, etc. on fixed, removable, and network drives. When executed, the ransomware copies itself into the following location: %temp%\svchost.exe and adds a registry entry in order to be executed on every system start.
The attack vector is a regular email message with an attachment (previous variants were using Word or Excel attachments containing malicious macros). This attachment comes with a Trojan Downloader, usually from the Family detected by ESET as JS/TrojanDownloader.Nemucod, among other variants. Once opened, this file contains a JavaScript (.js) file and when it’s executed it downloads and executes the payload, Locky in this case.
}}