SYMBOLCOMMON_NAMEaka. SYNONYMS
win.lockergoga (Back to overview)

LockerGoga

Actor(s): FIN6


According to Trend Micro, LockerGoga is a ransomware that has been used in multiple attacks, most notably against Altran Technologies and Norsk Hydro. It encrypts a range of documents and source code files but certain versions had little to no whitelist that would protect import system files such as the Windows Boot Manager.

References
2020-07-15FireEyeNathan Brubaker, Daniel Kapellmann Zafra, Keith Lunden, Ken Proska, Corey Hildebrandt
@online{brubaker:20200715:financially:f217555, author = {Nathan Brubaker and Daniel Kapellmann Zafra and Keith Lunden and Ken Proska and Corey Hildebrandt}, title = {{Financially Motivated Actors Are Expanding Access Into OT: Analysis of Kill Lists That Include OT Processes Used With Seven Malware Families}}, date = {2020-07-15}, organization = {FireEye}, url = {https://www.fireeye.com/blog/threat-research/2020/07/financially-motivated-actors-are-expanding-access-into-ot.html}, language = {English}, urldate = {2020-07-16} } Financially Motivated Actors Are Expanding Access Into OT: Analysis of Kill Lists That Include OT Processes Used With Seven Malware Families
DoppelPaymer LockerGoga Maze MegaCortex Nefilim Ransomware Snake Ransomware
2020-03-05MicrosoftMicrosoft Threat Protection Intelligence Team
@online{team:20200305:humanoperated:d90a28e, author = {Microsoft Threat Protection Intelligence Team}, title = {{Human-operated ransomware attacks: A preventable disaster}}, date = {2020-03-05}, organization = {Microsoft}, url = {https://www.microsoft.com/security/blog/2020/03/05/human-operated-ransomware-attacks-a-preventable-disaster/}, language = {English}, urldate = {2020-03-06} } Human-operated ransomware attacks: A preventable disaster
Dharma DoppelPaymer Dridex EternalPetya Gandcrab Hermes LockerGoga MegaCortex MimiKatz REvil RobinHood Ryuk SamSam TrickBot WannaCryptor
2020-03-04CrowdStrikeCrowdStrike
@techreport{crowdstrike:20200304:2020:818c85f, author = {CrowdStrike}, title = {{2020 CrowdStrike Global Threat Report}}, date = {2020-03-04}, institution = {CrowdStrike}, url = {https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf}, language = {English}, urldate = {2020-07-24} } 2020 CrowdStrike Global Threat Report
MESSAGETAP More_eggs 8.t Dropper Anchor BabyShark BadNews Clop Cobalt Strike CobInt Cobra Carbon System Cutwail DanaBot Dharma DoppelPaymer Dridex Emotet FlawedAmmyy FriedEx Gandcrab Get2 IcedID ISFB KerrDown LightNeuron LockerGoga Maze MECHANICAL Necurs Nokki Outlook Backdoor Phobos Ransomware Predator The Thief QakBot REvil RobinHood Ryuk SDBbot Skipper SmokeLoader TerraRecon TerraStealer TerraTV TinyLoader TrickBot vidar Winnti ANTHROPOID SPIDER Anunak APT31 APT39 BlackTech BuhTrap Charming Kitten CLOCKWORD SPIDER DOPPEL SPIDER Gamaredon Group Leviathan MONTY SPIDER Mustang Panda NARWHAL SPIDER NOCTURNAL SPIDER Pinchy Spider Pirate Panda Salty Spider SCULLY SPIDER SMOKY SPIDER Thrip VENOM SPIDER
2020-03-03PWC UKPWC UK
@techreport{uk:20200303:cyber:1f1eef0, author = {PWC UK}, title = {{Cyber Threats 2019:A Year in Retrospect}}, date = {2020-03-03}, institution = {PWC UK}, url = {https://www.pwc.co.uk/cyber-security/assets/cyber-threats-2019-retrospect.pdf}, language = {English}, urldate = {2020-03-03} } Cyber Threats 2019:A Year in Retrospect
KevDroid MESSAGETAP magecart AndroMut Cobalt Strike CobInt Crimson RAT DNSpionage Dridex Dtrack Emotet FlawedAmmyy FlawedGrace FriedEx Gandcrab Get2 GlobeImposter Grateful POS ISFB Kazuar LockerGoga Nokki QakBot Ramnit REvil Rifdoor RokRAT Ryuk shadowhammer ShadowPad Shifu Skipper StoneDrill Stuxnet TrickBot Winnti ZeroCleare Axiom
2020-03DragosJoe Slowik
@techreport{slowik:202003:spyware:412ef8a, author = {Joe Slowik}, title = {{Spyware Stealer Locker Wiper Locker Goga Revisited}}, date = {2020-03}, institution = {Dragos}, url = {https://dragos.com/wp-content/uploads/Spyware-Stealer-Locker-Wiper-LockerGoga-Revisited.pdf}, language = {English}, urldate = {2020-03-18} } Spyware Stealer Locker Wiper Locker Goga Revisited
LockerGoga
2020-02-19FireEyeFireEye
@online{fireeye:20200219:mtrends:193613a, author = {FireEye}, title = {{M-Trends 2020}}, date = {2020-02-19}, organization = {FireEye}, url = {https://content.fireeye.com/m-trends/rpt-m-trends-2020}, language = {English}, urldate = {2020-02-20} } M-Trends 2020
Cobalt Strike Grateful POS LockerGoga QakBot TrickBot
2020-01-29ANSSIANSSI
@techreport{anssi:20200129:tat:3d59e6e, author = {ANSSI}, title = {{État de la menace rançongiciel}}, date = {2020-01-29}, institution = {ANSSI}, url = {https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-001.pdf}, language = {English}, urldate = {2020-02-03} } État de la menace rançongiciel
Clop Dharma FriedEx Gandcrab LockerGoga Maze MegaCortex REvil RobinHood Ryuk SamSam
2019-12-23Bleeping ComputerLawrence Abrams
@online{abrams:20191223:fbi:7c11cf8, author = {Lawrence Abrams}, title = {{FBI Issues Alert For LockerGoga and MegaCortex Ransomware}}, date = {2019-12-23}, organization = {Bleeping Computer}, url = {https://www.bleepingcomputer.com/news/security/fbi-issues-alert-for-lockergoga-and-megacortex-ransomware/}, language = {English}, urldate = {2020-01-08} } FBI Issues Alert For LockerGoga and MegaCortex Ransomware
LockerGoga MegaCortex
2019-05-19nrkHenrik Lied, Peter Svaar, Dennis Ravndal, Anders Brekke, Kristine Hirsti
@online{lied:20190519:skreddersydd:e16c8d8, author = {Henrik Lied and Peter Svaar and Dennis Ravndal and Anders Brekke and Kristine Hirsti}, title = {{Skreddersydd dobbeltangrep mot Hydro}}, date = {2019-05-19}, organization = {nrk}, url = {https://www.nrk.no/norge/skreddersydd-dobbeltangrep-mot-hydro-1.14480202}, language = {Norwegian}, urldate = {2019-11-21} } Skreddersydd dobbeltangrep mot Hydro
LockerGoga
2019-05-09GovCERT.chGovCERT.ch
@online{govcertch:20190509:severe:2767782, author = {GovCERT.ch}, title = {{Severe Ransomware Attacks Against Swiss SMEs}}, date = {2019-05-09}, organization = {GovCERT.ch}, url = {https://www.govcert.admin.ch/blog/36/severe-ransomware-attacks-against-swiss-smes}, language = {English}, urldate = {2019-07-11} } Severe Ransomware Attacks Against Swiss SMEs
Emotet LockerGoga Ryuk TrickBot
2019-05-04Abuse.ioAbuse.io
@online{abuseio:20190504:abuseio:d5062ca, author = {Abuse.io}, title = {{Abuse.io Report - Lockergoga}}, date = {2019-05-04}, organization = {Abuse.io}, url = {https://www.abuse.io/lockergoga.txt}, language = {English}, urldate = {2020-01-07} } Abuse.io Report - Lockergoga
LockerGoga
2019-04-16Youtube (Norsk Hydro)Norsk Hydro
@online{hydro:20190416:cyber:ada48a4, author = {Norsk Hydro}, title = {{The cyber attack rescue operation in Hydro Toulouse}}, date = {2019-04-16}, organization = {Youtube (Norsk Hydro)}, url = {https://www.youtube.com/watch?v=o6eEN0mUakM}, language = {English}, urldate = {2020-01-13} } The cyber attack rescue operation in Hydro Toulouse
LockerGoga
2019-04-05FireEyeBrendan McKeague, Van Ta, Ben Fedore, Geoff Ackerman, Alex Pennino, Andrew Thompson, Douglas Bienstock
@online{mckeague:20190405:picksix:d101a59, author = {Brendan McKeague and Van Ta and Ben Fedore and Geoff Ackerman and Alex Pennino and Andrew Thompson and Douglas Bienstock}, title = {{Pick-Six: Intercepting a FIN6 Intrusion, an Actor Recently Tied to Ryuk and LockerGoga Ransomware}}, date = {2019-04-05}, organization = {FireEye}, url = {https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html}, language = {English}, urldate = {2019-12-20} } Pick-Six: Intercepting a FIN6 Intrusion, an Actor Recently Tied to Ryuk and LockerGoga Ransomware
LockerGoga Ryuk FIN6
2019-04-02HelpNetSecurityZeljka Zorz
@online{zorz:20190402:lockergoga:7fe224d, author = {Zeljka Zorz}, title = {{A LockerGoga primer and decrypters for Mira and Aurora ransomwares}}, date = {2019-04-02}, organization = {HelpNetSecurity}, url = {https://www.helpnetsecurity.com/2019/04/02/aurora-decrypter-mira-decrypter/}, language = {English}, urldate = {2019-12-16} } A LockerGoga primer and decrypters for Mira and Aurora ransomwares
LockerGoga
2019-03-21DoublePulsarKevin Beaumont
@online{beaumont:20190321:how:ecfbbf1, author = {Kevin Beaumont}, title = {{How Lockergoga took down Hydro — ransomware used in targeted attacks aimed at big business}}, date = {2019-03-21}, organization = {DoublePulsar}, url = {https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880}, language = {English}, urldate = {2019-11-29} } How Lockergoga took down Hydro — ransomware used in targeted attacks aimed at big business
LockerGoga
2019-01-30Bleeping ComputerIonut Ilascu
@online{ilascu:20190130:new:5c2d8da, author = {Ionut Ilascu}, title = {{New LockerGoga Ransomware Allegedly Used in Altran Attack}}, date = {2019-01-30}, organization = {Bleeping Computer}, url = {https://www.bleepingcomputer.com/news/security/new-lockergoga-ransomware-allegedly-used-in-altran-attack/}, language = {English}, urldate = {2019-12-20} } New LockerGoga Ransomware Allegedly Used in Altran Attack
LockerGoga
Yara Rules
[TLP:WHITE] win_lockergoga_auto (20201023 | autogenerated rule brought to you by yara-signator)
rule win_lockergoga_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2020-12-22"
        version = "1"
        description = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lockergoga"
        malpedia_rule_date = "20201222"
        malpedia_hash = "30354d830a29f0fbd3714d93d94dea941d77a130"
        malpedia_version = "20201023"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 83cf02 897d90 0f1008 f30f7e4010 c7401000000000 c740140f000000 0f114dc0 }
            // n = 7, score = 400
            //   83cf02               | or                  edi, 2
            //   897d90               | mov                 dword ptr [ebp - 0x70], edi
            //   0f1008               | movups              xmm1, xmmword ptr [eax]
            //   f30f7e4010           | movq                xmm0, qword ptr [eax + 0x10]
            //   c7401000000000       | mov                 dword ptr [eax + 0x10], 0
            //   c740140f000000       | mov                 dword ptr [eax + 0x14], 0xf
            //   0f114dc0             | movups              xmmword ptr [ebp - 0x40], xmm1

        $sequence_1 = { 5d c3 8b450c 03de 03c6 895d08 8945f8 }
            // n = 7, score = 400
            //   5d                   | pop                 ebp
            //   c3                   | ret                 
            //   8b450c               | mov                 eax, dword ptr [ebp + 0xc]
            //   03de                 | add                 ebx, esi
            //   03c6                 | add                 eax, esi
            //   895d08               | mov                 dword ptr [ebp + 8], ebx
            //   8945f8               | mov                 dword ptr [ebp - 8], eax

        $sequence_2 = { c645fc1b e8???????? 8d4db4 c645fc0e e8???????? 8b4d9c 8b06 }
            // n = 7, score = 400
            //   c645fc1b             | mov                 byte ptr [ebp - 4], 0x1b
            //   e8????????           |                     
            //   8d4db4               | lea                 ecx, [ebp - 0x4c]
            //   c645fc0e             | mov                 byte ptr [ebp - 4], 0xe
            //   e8????????           |                     
            //   8b4d9c               | mov                 ecx, dword ptr [ebp - 0x64]
            //   8b06                 | mov                 eax, dword ptr [esi]

        $sequence_3 = { 897e04 c6460800 e8???????? 83c408 8945b8 8d4dc0 c745d000000000 }
            // n = 7, score = 400
            //   897e04               | mov                 dword ptr [esi + 4], edi
            //   c6460800             | mov                 byte ptr [esi + 8], 0
            //   e8????????           |                     
            //   83c408               | add                 esp, 8
            //   8945b8               | mov                 dword ptr [ebp - 0x48], eax
            //   8d4dc0               | lea                 ecx, [ebp - 0x40]
            //   c745d000000000       | mov                 dword ptr [ebp - 0x30], 0

        $sequence_4 = { ff5018 56 50 8bcb ffd7 8b4d10 50 }
            // n = 7, score = 400
            //   ff5018               | call                dword ptr [eax + 0x18]
            //   56                   | push                esi
            //   50                   | push                eax
            //   8bcb                 | mov                 ecx, ebx
            //   ffd7                 | call                edi
            //   8b4d10               | mov                 ecx, dword ptr [ebp + 0x10]
            //   50                   | push                eax

        $sequence_5 = { 8bc1 c1c00a 33d0 8bc1 c1c802 8bcb 334df0 }
            // n = 7, score = 400
            //   8bc1                 | mov                 eax, ecx
            //   c1c00a               | rol                 eax, 0xa
            //   33d0                 | xor                 edx, eax
            //   8bc1                 | mov                 eax, ecx
            //   c1c802               | ror                 eax, 2
            //   8bcb                 | mov                 ecx, ebx
            //   334df0               | xor                 ecx, dword ptr [ebp - 0x10]

        $sequence_6 = { c645fc02 394db4 7435 c7411000000000 c7411400000000 0f1000 0f1101 }
            // n = 7, score = 400
            //   c645fc02             | mov                 byte ptr [ebp - 4], 2
            //   394db4               | cmp                 dword ptr [ebp - 0x4c], ecx
            //   7435                 | je                  0x37
            //   c7411000000000       | mov                 dword ptr [ecx + 0x10], 0
            //   c7411400000000       | mov                 dword ptr [ecx + 0x14], 0
            //   0f1000               | movups              xmm0, xmmword ptr [eax]
            //   0f1101               | movups              xmmword ptr [ecx], xmm0

        $sequence_7 = { ff75b8 e8???????? 59 8945b4 8b45b4 8945f0 8b45f4 }
            // n = 7, score = 400
            //   ff75b8               | push                dword ptr [ebp - 0x48]
            //   e8????????           |                     
            //   59                   | pop                 ecx
            //   8945b4               | mov                 dword ptr [ebp - 0x4c], eax
            //   8b45b4               | mov                 eax, dword ptr [ebp - 0x4c]
            //   8945f0               | mov                 dword ptr [ebp - 0x10], eax
            //   8b45f4               | mov                 eax, dword ptr [ebp - 0xc]

        $sequence_8 = { 8b435c 894708 8b4360 89470c 8b4364 894710 8bc6 }
            // n = 7, score = 400
            //   8b435c               | mov                 eax, dword ptr [ebx + 0x5c]
            //   894708               | mov                 dword ptr [edi + 8], eax
            //   8b4360               | mov                 eax, dword ptr [ebx + 0x60]
            //   89470c               | mov                 dword ptr [edi + 0xc], eax
            //   8b4364               | mov                 eax, dword ptr [ebx + 0x64]
            //   894710               | mov                 dword ptr [edi + 0x10], eax
            //   8bc6                 | mov                 eax, esi

        $sequence_9 = { e8???????? 6a01 68???????? 8d4dd8 e8???????? 83cf08 897d90 }
            // n = 7, score = 400
            //   e8????????           |                     
            //   6a01                 | push                1
            //   68????????           |                     
            //   8d4dd8               | lea                 ecx, [ebp - 0x28]
            //   e8????????           |                     
            //   83cf08               | or                  edi, 8
            //   897d90               | mov                 dword ptr [ebp - 0x70], edi

    condition:
        7 of them and filesize < 2588672
}
[TLP:WHITE] win_lockergoga_w0   (20190320 | Detects LockerGoga ransomware binaries)
rule win_lockergoga_w0 {   
    meta:   
        author = "Florian Roth"   
        description = "Detects LockerGoga ransomware binaries"   
        reference = "https://www.nrk.no/norge/skreddersydd-dobbeltangrep-mot-hydro-1.14480202"   
        license = "https://creativecommons.org/licenses/by-nc/4.0/"   
        date = "2019-03-19"   
        hash = "c97d9bbc80b573bdeeda3812f4d00e5183493dd0d5805e2508728f65977dda15"   
        hash = "7bcd69b3085126f7e97406889f78ab74e87230c11812b79406d723a80c08dd26"   
        hash = "bdf36127817413f625d2625d3133760af724d6ad2410bea7297ddc116abc268f"   
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lockergoga"
        malpedia_version = "20190320"
        malpedia_license = "CC BY-NC-SA 4.0"
        malpedia_sharing = "TLP:WHITE"
    strings:   
        $x1 = "\\.(doc|dot|wbk|docx|dotx|docb|xlm|xlsx|xltx|xlsb|xlw|ppt|pot|pps|pptx|potx|ppsx|sldx|pdf)" wide   
        $x2 = "|[A-Za-z]:\\cl.log" wide   
        $x4 = "\\crypto-locker\\" ascii   
        $xc1 = { 00 43 00 6F 00 6D 00 70 00 61 00 6E 00 79 00 4E   
          00 61 00 6D 00 65 00 00 00 00 00 4D 00 6C 00 63   
          00 72 00 6F 00 73 00 6F 00 66 00 74 }   
        $xc2 = { 00 2E 00 6C 00 6F 00 63 00 6B 00 65 00 64 00 00   
          00 20 46 41 49 4C 45 44 20 00 00 00 00 20 00 00   
          00 20 75 6E 6B 6E 6F 77 6E 20 65 78 63 65 70 74   
          69 6F 6E }   
        $rn1 = "This may lead to the impossibility of recovery of the certain files." wide   
    condition:   
        1 of ($x*) or $rn1
}
Download all Yara Rules