LockerGoga (Malware Family)

SYMBOL	COMMON_NAME	aka. SYNONYMS

win.lockergoga (Back to overview)

LockerGoga

Actor(s): FIN6

According to Trend Micro, LockerGoga is a ransomware that has been used in multiple attacks, most notably against Altran Technologies and Norsk Hydro. It encrypts a range of documents and source code files but certain versions had little to no whitelist that would protect import system files such as the Windows Boot Manager.

References

2021-10-29 ⋅ Національна поліція України ⋅ Національна поліція України
Cyberpolice exposes transnational criminal group in causing $ 120 million in damage to foreign companies
Cobalt Strike Dharma LockerGoga MegaCortex TrickBot

2021-10-29 ⋅ Europol ⋅ Europol
12 targeted for involvement in ransomware attacks against critical infrastructure
Cobalt Strike Dharma LockerGoga MegaCortex TrickBot

2020-07-15 ⋅ Mandiant ⋅ Nathan Brubaker, Daniel Kapellmann Zafra, Keith Lunden, Ken Proska, Corey Hildebrandt
Financially Motivated Actors Are Expanding Access Into OT: Analysis of Kill Lists That Include OT Processes Used With Seven Malware Families
Clop DoppelPaymer LockerGoga Maze MegaCortex Nefilim Snake

2020-03-05 ⋅ Microsoft ⋅ Microsoft Threat Protection Intelligence Team
Human-operated ransomware attacks: A preventable disaster
Dharma DoppelPaymer Dridex EternalPetya Gandcrab Hermes LockerGoga MegaCortex MimiKatz REvil RobinHood Ryuk SamSam TrickBot WannaCryptor PARINACOTA

2020-03-04 ⋅ CrowdStrike ⋅ CrowdStrike
2020 CrowdStrike Global Threat Report
MESSAGETAP More_eggs 8.t Dropper Anchor BabyShark BadNews Clop Cobalt Strike CobInt Cobra Carbon System Cutwail DanaBot Dharma DoppelDridex DoppelPaymer Dridex Emotet FlawedAmmyy FriedEx Gandcrab Get2 IcedID ISFB KerrDown LightNeuron LockerGoga Maze MECHANICAL Necurs Nokki Outlook Backdoor Phobos Predator The Thief QakBot REvil RobinHood Ryuk SDBbot Skipper SmokeLoader TerraRecon TerraStealer TerraTV TinyLoader TrickBot Vidar Winnti ANTHROPOID SPIDER APT23 APT31 APT39 APT40 BlackTech BuhTrap Charming Kitten CLOCKWORK SPIDER DOPPEL SPIDER FIN7 Gamaredon Group GOBLIN PANDA MONTY SPIDER MUSTANG PANDA NARWHAL SPIDER NOCTURNAL SPIDER PINCHY SPIDER SALTY SPIDER SCULLY SPIDER SMOKY SPIDER Thrip VENOM SPIDER VICEROY TIGER

2020-03-03 ⋅ PWC UK ⋅ PWC UK
Cyber Threats 2019:A Year in Retrospect
KevDroid MESSAGETAP magecart AndroMut Cobalt Strike CobInt Crimson RAT DNSpionage Dridex Dtrack Emotet FlawedAmmyy FlawedGrace FriedEx Gandcrab Get2 GlobeImposter Grateful POS ISFB Kazuar LockerGoga Nokki QakBot Ramnit REvil Rifdoor RokRAT Ryuk shadowhammer ShadowPad Shifu Skipper StoneDrill Stuxnet TrickBot Winnti ZeroCleare APT41 MUSTANG PANDA

2020-03 ⋅ Dragos ⋅ Joe Slowik
Spyware Stealer Locker Wiper Locker Goga Revisited
LockerGoga

2020-02-20 ⋅ McAfee ⋅ Christiaan Beek, Eamonn Ryan, Darren Fitzpatrick
CSI: Evidence Indicators for Targeted Ransomware Attacks – Part II
Cobalt Strike LockerGoga Maze MegaCortex

2020-02-19 ⋅ FireEye ⋅ FireEye
M-Trends 2020
Cobalt Strike Grateful POS LockerGoga QakBot TrickBot

2020-01-29 ⋅ ANSSI ⋅ ANSSI
État de la menace rançongiciel
Clop Dharma FriedEx Gandcrab LockerGoga Maze MegaCortex REvil RobinHood Ryuk SamSam

2019-12-23 ⋅ Bleeping Computer ⋅ Lawrence Abrams
FBI Issues Alert For LockerGoga and MegaCortex Ransomware
LockerGoga MegaCortex

2019-05-19 ⋅ nrk ⋅ Henrik Lied, Peter Svaar, Dennis Ravndal, Anders Brekke, Kristine Hirsti
Skreddersydd dobbeltangrep mot Hydro
LockerGoga

2019-05-09 ⋅ GovCERT.ch ⋅ GovCERT.ch
Severe Ransomware Attacks Against Swiss SMEs
Emotet LockerGoga Ryuk TrickBot

2019-05-04 ⋅ Abuse.io ⋅ Abuse.io
Abuse.io Report - Lockergoga
LockerGoga

2019-04-16 ⋅ Youtube (Norsk Hydro) ⋅ Norsk Hydro
The cyber attack rescue operation in Hydro Toulouse
LockerGoga

2019-04-05 ⋅ FireEye ⋅ Brendan McKeague, Van Ta, Ben Fedore, Geoff Ackerman, Alex Pennino, Andrew Thompson, Douglas Bienstock
Pick-Six: Intercepting a FIN6 Intrusion, an Actor Recently Tied to Ryuk and LockerGoga Ransomware
LockerGoga Ryuk FIN6

2019-04-02 ⋅ HelpNetSecurity ⋅ Zeljka Zorz
A LockerGoga primer and decrypters for Mira and Aurora ransomwares
LockerGoga

2019-03-21 ⋅ DoublePulsar ⋅ Kevin Beaumont
How Lockergoga took down Hydro — ransomware used in targeted attacks aimed at big business
LockerGoga

2019-03-20 ⋅ Cisco Talos ⋅ Nick Biasini
Ransomware or Wiper? LockerGoga Straddles the Line
LockerGoga

2019-01-30 ⋅ Bleeping Computer ⋅ Ionut Ilascu
New LockerGoga Ransomware Allegedly Used in Altran Attack
LockerGoga

Yara Rules

[TLP:WHITE] win_lockergoga_auto (20230407 | Detects win.lockergoga.)

rule win_lockergoga_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-03-28"
        version = "1"
        description = "Detects win.lockergoga."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lockergoga"
        malpedia_rule_date = "20230328"
        malpedia_hash = "9d2d75cef573c1c2d861f5197df8f563b05a305d"
        malpedia_version = "20230407"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 7558 8d4dc0 8b07 51 8d4da8 8b5060 8d045b }
            // n = 7, score = 400
            //   7558                 | jne                 0x5a
            //   8d4dc0               | lea                 ecx, [ebp - 0x40]
            //   8b07                 | mov                 eax, dword ptr [edi]
            //   51                   | push                ecx
            //   8d4da8               | lea                 ecx, [ebp - 0x58]
            //   8b5060               | mov                 edx, dword ptr [eax + 0x60]
            //   8d045b               | lea                 eax, [ebx + ebx*2]

        $sequence_1 = { e8???????? 85ff 0f8473020000 897de8 bf9a050000 c745f000000000 8975e4 }
            // n = 7, score = 400
            //   e8????????           |                     
            //   85ff                 | test                edi, edi
            //   0f8473020000         | je                  0x279
            //   897de8               | mov                 dword ptr [ebp - 0x18], edi
            //   bf9a050000           | mov                 edi, 0x59a
            //   c745f000000000       | mov                 dword ptr [ebp - 0x10], 0
            //   8975e4               | mov                 dword ptr [ebp - 0x1c], esi

        $sequence_2 = { 290b 897e44 740a 8b4634 034630 3bf8 7506 }
            // n = 7, score = 400
            //   290b                 | sub                 dword ptr [ebx], ecx
            //   897e44               | mov                 dword ptr [esi + 0x44], edi
            //   740a                 | je                  0xc
            //   8b4634               | mov                 eax, dword ptr [esi + 0x34]
            //   034630               | add                 eax, dword ptr [esi + 0x30]
            //   3bf8                 | cmp                 edi, eax
            //   7506                 | jne                 8

        $sequence_3 = { 8b16 8bce 85c0 7411 ff92a4000000 5e 8b08 }
            // n = 7, score = 400
            //   8b16                 | mov                 edx, dword ptr [esi]
            //   8bce                 | mov                 ecx, esi
            //   85c0                 | test                eax, eax
            //   7411                 | je                  0x13
            //   ff92a4000000         | call                dword ptr [edx + 0xa4]
            //   5e                   | pop                 esi
            //   8b08                 | mov                 ecx, dword ptr [eax]

        $sequence_4 = { ff90a4000000 8bc8 8b10 8b4240 ffd0 8b4df4 64890d00000000 }
            // n = 7, score = 400
            //   ff90a4000000         | call                dword ptr [eax + 0xa4]
            //   8bc8                 | mov                 ecx, eax
            //   8b10                 | mov                 edx, dword ptr [eax]
            //   8b4240               | mov                 eax, dword ptr [edx + 0x40]
            //   ffd0                 | call                eax
            //   8b4df4               | mov                 ecx, dword ptr [ebp - 0xc]
            //   64890d00000000       | mov                 dword ptr fs:[0], ecx

        $sequence_5 = { 8b49fc 83c223 2bc1 83c0fc 83f81f 0f87ab020000 52 }
            // n = 7, score = 400
            //   8b49fc               | mov                 ecx, dword ptr [ecx - 4]
            //   83c223               | add                 edx, 0x23
            //   2bc1                 | sub                 eax, ecx
            //   83c0fc               | add                 eax, -4
            //   83f81f               | cmp                 eax, 0x1f
            //   0f87ab020000         | ja                  0x2b1
            //   52                   | push                edx

        $sequence_6 = { 8bf0 83c404 8975fc 85f6 7422 57 8bce }
            // n = 7, score = 400
            //   8bf0                 | mov                 esi, eax
            //   83c404               | add                 esp, 4
            //   8975fc               | mov                 dword ptr [ebp - 4], esi
            //   85f6                 | test                esi, esi
            //   7422                 | je                  0x24
            //   57                   | push                edi
            //   8bce                 | mov                 ecx, esi

        $sequence_7 = { 83f81f 0f877f050000 53 51 e8???????? 8b4dd4 83c408 }
            // n = 7, score = 400
            //   83f81f               | cmp                 eax, 0x1f
            //   0f877f050000         | ja                  0x585
            //   53                   | push                ebx
            //   51                   | push                ecx
            //   e8????????           |                     
            //   8b4dd4               | mov                 ecx, dword ptr [ebp - 0x2c]
            //   83c408               | add                 esp, 8

        $sequence_8 = { 83c40c 85c0 7404 2bc3 eb03 83c8ff 48 }
            // n = 7, score = 400
            //   83c40c               | add                 esp, 0xc
            //   85c0                 | test                eax, eax
            //   7404                 | je                  6
            //   2bc3                 | sub                 eax, ebx
            //   eb03                 | jmp                 5
            //   83c8ff               | or                  eax, 0xffffffff
            //   48                   | dec                 eax

        $sequence_9 = { e8???????? 6a08 68???????? 8d4da8 c645fc0c c745b800000000 c745bc0f000000 }
            // n = 7, score = 400
            //   e8????????           |                     
            //   6a08                 | push                8
            //   68????????           |                     
            //   8d4da8               | lea                 ecx, [ebp - 0x58]
            //   c645fc0c             | mov                 byte ptr [ebp - 4], 0xc
            //   c745b800000000       | mov                 dword ptr [ebp - 0x48], 0
            //   c745bc0f000000       | mov                 dword ptr [ebp - 0x44], 0xf

    condition:
        7 of them and filesize < 2588672
}

[TLP:WHITE] win_lockergoga_w0 (20190320 | Detects LockerGoga ransomware binaries)

rule win_lockergoga_w0 {   
    meta:   
        author = "Florian Roth"   
        description = "Detects LockerGoga ransomware binaries"   
        reference = "https://www.nrk.no/norge/skreddersydd-dobbeltangrep-mot-hydro-1.14480202"   
        license = "https://creativecommons.org/licenses/by-nc/4.0/"   
        date = "2019-03-19"   
        hash = "c97d9bbc80b573bdeeda3812f4d00e5183493dd0d5805e2508728f65977dda15"   
        hash = "7bcd69b3085126f7e97406889f78ab74e87230c11812b79406d723a80c08dd26"   
        hash = "bdf36127817413f625d2625d3133760af724d6ad2410bea7297ddc116abc268f"   
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lockergoga"
        malpedia_version = "20190320"
        malpedia_license = "CC BY-NC-SA 4.0"
        malpedia_sharing = "TLP:WHITE"
    strings:   
        $x1 = "\\.(doc|dot|wbk|docx|dotx|docb|xlm|xlsx|xltx|xlsb|xlw|ppt|pot|pps|pptx|potx|ppsx|sldx|pdf)" wide   
        $x2 = "|[A-Za-z]:\\cl.log" wide   
        $x4 = "\\crypto-locker\\" ascii   
        $xc1 = { 00 43 00 6F 00 6D 00 70 00 61 00 6E 00 79 00 4E   
          00 61 00 6D 00 65 00 00 00 00 00 4D 00 6C 00 63   
          00 72 00 6F 00 73 00 6F 00 66 00 74 }   
        $xc2 = { 00 2E 00 6C 00 6F 00 63 00 6B 00 65 00 64 00 00   
          00 20 46 41 49 4C 45 44 20 00 00 00 00 20 00 00   
          00 20 75 6E 6B 6E 6F 77 6E 20 65 78 63 65 70 74   
          69 6F 6E }   
        $rn1 = "This may lead to the impossibility of recovery of the certain files." wide   
    condition:   
        1 of ($x*) or $rn1
}

Download all Yara Rules

LockerGoga Propose Change

References

Yara Rules

LockerGoga