Sandstorm does not recognize Locky?

Hi rsc,

Do you still have the zip? can you send a copy of it to samples@sophos.com and CC in support@sophos.com and we can take a look for you.

Peter,

just sent 2 samples, which are not recognized by UTM 9.4 Sandstorm. Case # is #5809716.

Mail Security with Sandstorm on UTM 9.400-9 still does not recognize Locky JS-Downloaders, although the behavior is obvious.

https://www.virustotal.com/de/file/76609f82340106c12d42fe176c632d5153a1a6a1e4b75f80cf4b0c1579efdc66/analysis/1458600681/

https://www.virustotal.com/de/file/554b28a723610b61544f58369df6bcb62416796b904516af53a6c147f420f94f/analysis/1458602994/

I submitted the 2 files under the same case #5809716

BTW: The submission form https://secure2.sophos.com/en-us/support/contact-support/sample-submission.aspx misses UTM series in selection list:

really not what we are looking for than if sandstorm doesn't even detect locky ... 

to be fair, alot of scan engines and sandboxes do not detect it, but all you heard on the cebit was locky talk and how sandstorm will detect it etc. - guess not

Strange, yeah thought that is what it is specifically made to do. I wonder if Sandstorm has a MS office framework to check office macros, or if Locky has some logic to act differently in virtualized environments.

Hi everyone,

We just wanted to let you know that we are working with this customer at the moment to understand exactly what happened. This is still an ongoing investigation and could have been caused by many reasons. We do know that Sandstorm can and has stopped variants of ransomware including Locky in the past. Once we have more information regarding this issue we will post an update.

Thanks

Hi everyone,

We just wanted to let you know that we are working with this customer at the moment to understand exactly what happened. This is still an ongoing investigation and could have been caused by many reasons. We do know that Sandstorm can and has stopped variants of ransomware including Locky in the past. Once we have more information regarding this issue we will post an update.

Thanks

Peter,

do you have any update on that?

Thanks.