Pierluigi Paganini September 24, 2017

Researchers at PhishMe found the names of Game of Thrones show characters and other references into the script used to spread the Locky ransomware.

The fantasy drama television series Game of Thrones has an amazing number of fans, including the authors of the Locky ransomware.

The discovery was made by researchers at security firm PhishMe that found the names of show characters and other references into the source code of the Visual Basic script used by the crooks.

The Visual Basic script is included in the ZIP or RAR archive attached to email spam used in the ransomware campaign. When the victims open the archive and run the VB script contained within, it would download and install the Locky ransomware.

“Lightweight script applications designed to deliver malware often use rotating or pseudorandom variable names to ensure that the malware delivery tools look unique. In this case, many of the variables (some misspelled) referred to characters and events from the globally-popular television fantasy epic Game of Thrones.” states Phishme.

Experts discovered in the VB script reference to the TV show such as “Aria,” “SansaStark,” “RobertBaration,” “JohnSnow,” or “HoldTheDoor” .

According to BleepingComputer, the term “Throne” was used 70 times inside the script.

“The runtime for this script is indifferent to the variable names. The variable names could be anything, including completely random combinations of letters and numbers. However, the criminals responsible for this attack chose a distinctive theme for their variables, thereby revealing their interest in this pop culture phenomenon.” continues PhishMe.

[adrotate banner=”9″]

Pierluigi Paganini

(Security Affairs – Locky ransomware, Game of Thrones)

[adrotate banner=”12″]