SYMBOLCOMMON_NAMEaka. SYNONYMS
win.lockergoga (Back to overview)

LockerGoga

Actor(s): FIN6


According to Trend Micro, LockerGoga is a ransomware that has been used in multiple attacks, most notably against Altran Technologies and Norsk Hydro. It encrypts a range of documents and source code files but certain versions had little to no whitelist that would protect import system files such as the Windows Boot Manager.

References
2020-07-15FireEyeNathan Brubaker, Daniel Kapellmann Zafra, Keith Lunden, Ken Proska, Corey Hildebrandt
@online{brubaker:20200715:financially:f217555, author = {Nathan Brubaker and Daniel Kapellmann Zafra and Keith Lunden and Ken Proska and Corey Hildebrandt}, title = {{Financially Motivated Actors Are Expanding Access Into OT: Analysis of Kill Lists That Include OT Processes Used With Seven Malware Families}}, date = {2020-07-15}, organization = {FireEye}, url = {https://www.fireeye.com/blog/threat-research/2020/07/financially-motivated-actors-are-expanding-access-into-ot.html}, language = {English}, urldate = {2020-07-16} } Financially Motivated Actors Are Expanding Access Into OT: Analysis of Kill Lists That Include OT Processes Used With Seven Malware Families
DoppelPaymer LockerGoga Maze MegaCortex Nefilim Ransomware Snake Ransomware
2020-03-05MicrosoftMicrosoft Threat Protection Intelligence Team
@online{team:20200305:humanoperated:d90a28e, author = {Microsoft Threat Protection Intelligence Team}, title = {{Human-operated ransomware attacks: A preventable disaster}}, date = {2020-03-05}, organization = {Microsoft}, url = {https://www.microsoft.com/security/blog/2020/03/05/human-operated-ransomware-attacks-a-preventable-disaster/}, language = {English}, urldate = {2020-03-06} } Human-operated ransomware attacks: A preventable disaster
Dharma DoppelPaymer Dridex EternalPetya Gandcrab Hermes LockerGoga MegaCortex MimiKatz REvil RobinHood Ryuk SamSam TrickBot WannaCryptor
2020-03-04CrowdStrikeCrowdStrike
@techreport{crowdstrike:20200304:2020:818c85f, author = {CrowdStrike}, title = {{2020 CrowdStrike Global Threat Report}}, date = {2020-03-04}, institution = {CrowdStrike}, url = {https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf}, language = {English}, urldate = {2020-07-24} } 2020 CrowdStrike Global Threat Report
MESSAGETAP More_eggs 8.t Dropper Anchor BabyShark BadNews Clop Cobalt Strike CobInt Cobra Carbon System Cutwail DanaBot Dharma DoppelPaymer Dridex Emotet FlawedAmmyy FriedEx Gandcrab Get2 IcedID ISFB KerrDown LightNeuron LockerGoga Maze MECHANICAL Necurs Nokki Outlook Backdoor Phobos Ransomware Predator The Thief QakBot REvil RobinHood Ryuk SDBbot Skipper SmokeLoader TerraRecon TerraStealer TerraTV TinyLoader TrickBot vidar Winnti ANTHROPOID SPIDER Anunak APT31 APT39 BlackTech BuhTrap Charming Kitten CLOCKWORD SPIDER DOPPEL SPIDER Gamaredon Group Leviathan MONTY SPIDER Mustang Panda NARWHAL SPIDER NOCTURNAL SPIDER Pinchy Spider Pirate Panda Salty Spider SCULLY SPIDER SMOKY SPIDER Thrip VENOM SPIDER
2020-03-03PWC UKPWC UK
@techreport{uk:20200303:cyber:1f1eef0, author = {PWC UK}, title = {{Cyber Threats 2019:A Year in Retrospect}}, date = {2020-03-03}, institution = {PWC UK}, url = {https://www.pwc.co.uk/cyber-security/assets/cyber-threats-2019-retrospect.pdf}, language = {English}, urldate = {2020-03-03} } Cyber Threats 2019:A Year in Retrospect
KevDroid MESSAGETAP magecart AndroMut Cobalt Strike CobInt Crimson RAT DNSpionage Dridex Dtrack Emotet FlawedAmmyy FlawedGrace FriedEx Gandcrab Get2 GlobeImposter Grateful POS ISFB Kazuar LockerGoga Nokki QakBot Ramnit REvil Rifdoor RokRAT Ryuk shadowhammer ShadowPad Shifu Skipper StoneDrill Stuxnet TrickBot Winnti ZeroCleare Axiom
2020-03DragosJoe Slowik
@techreport{slowik:202003:spyware:412ef8a, author = {Joe Slowik}, title = {{Spyware Stealer Locker Wiper Locker Goga Revisited}}, date = {2020-03}, institution = {Dragos}, url = {https://dragos.com/wp-content/uploads/Spyware-Stealer-Locker-Wiper-LockerGoga-Revisited.pdf}, language = {English}, urldate = {2020-03-18} } Spyware Stealer Locker Wiper Locker Goga Revisited
LockerGoga
2020-02-19FireEyeFireEye
@online{fireeye:20200219:mtrends:193613a, author = {FireEye}, title = {{M-Trends 2020}}, date = {2020-02-19}, organization = {FireEye}, url = {https://content.fireeye.com/m-trends/rpt-m-trends-2020}, language = {English}, urldate = {2020-02-20} } M-Trends 2020
Cobalt Strike Grateful POS LockerGoga QakBot TrickBot
2020-01-29ANSSIANSSI
@techreport{anssi:20200129:tat:3d59e6e, author = {ANSSI}, title = {{État de la menace rançongiciel}}, date = {2020-01-29}, institution = {ANSSI}, url = {https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-001.pdf}, language = {English}, urldate = {2020-02-03} } État de la menace rançongiciel
Clop Dharma FriedEx Gandcrab LockerGoga Maze MegaCortex REvil RobinHood Ryuk SamSam
2019-12-23Bleeping ComputerLawrence Abrams
@online{abrams:20191223:fbi:7c11cf8, author = {Lawrence Abrams}, title = {{FBI Issues Alert For LockerGoga and MegaCortex Ransomware}}, date = {2019-12-23}, organization = {Bleeping Computer}, url = {https://www.bleepingcomputer.com/news/security/fbi-issues-alert-for-lockergoga-and-megacortex-ransomware/}, language = {English}, urldate = {2020-01-08} } FBI Issues Alert For LockerGoga and MegaCortex Ransomware
LockerGoga MegaCortex
2019-05-19nrkHenrik Lied, Peter Svaar, Dennis Ravndal, Anders Brekke, Kristine Hirsti
@online{lied:20190519:skreddersydd:e16c8d8, author = {Henrik Lied and Peter Svaar and Dennis Ravndal and Anders Brekke and Kristine Hirsti}, title = {{Skreddersydd dobbeltangrep mot Hydro}}, date = {2019-05-19}, organization = {nrk}, url = {https://www.nrk.no/norge/skreddersydd-dobbeltangrep-mot-hydro-1.14480202}, language = {Norwegian}, urldate = {2019-11-21} } Skreddersydd dobbeltangrep mot Hydro
LockerGoga
2019-05-09GovCERT.chGovCERT.ch
@online{govcertch:20190509:severe:2767782, author = {GovCERT.ch}, title = {{Severe Ransomware Attacks Against Swiss SMEs}}, date = {2019-05-09}, organization = {GovCERT.ch}, url = {https://www.govcert.admin.ch/blog/36/severe-ransomware-attacks-against-swiss-smes}, language = {English}, urldate = {2019-07-11} } Severe Ransomware Attacks Against Swiss SMEs
Emotet LockerGoga Ryuk TrickBot
2019-05-04Abuse.ioAbuse.io
@online{abuseio:20190504:abuseio:d5062ca, author = {Abuse.io}, title = {{Abuse.io Report - Lockergoga}}, date = {2019-05-04}, organization = {Abuse.io}, url = {https://www.abuse.io/lockergoga.txt}, language = {English}, urldate = {2020-01-07} } Abuse.io Report - Lockergoga
LockerGoga
2019-04-16Youtube (Norsk Hydro)Norsk Hydro
@online{hydro:20190416:cyber:ada48a4, author = {Norsk Hydro}, title = {{The cyber attack rescue operation in Hydro Toulouse}}, date = {2019-04-16}, organization = {Youtube (Norsk Hydro)}, url = {https://www.youtube.com/watch?v=o6eEN0mUakM}, language = {English}, urldate = {2020-01-13} } The cyber attack rescue operation in Hydro Toulouse
LockerGoga
2019-04-05FireEyeBrendan McKeague, Van Ta, Ben Fedore, Geoff Ackerman, Alex Pennino, Andrew Thompson, Douglas Bienstock
@online{mckeague:20190405:picksix:d101a59, author = {Brendan McKeague and Van Ta and Ben Fedore and Geoff Ackerman and Alex Pennino and Andrew Thompson and Douglas Bienstock}, title = {{Pick-Six: Intercepting a FIN6 Intrusion, an Actor Recently Tied to Ryuk and LockerGoga Ransomware}}, date = {2019-04-05}, organization = {FireEye}, url = {https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html}, language = {English}, urldate = {2019-12-20} } Pick-Six: Intercepting a FIN6 Intrusion, an Actor Recently Tied to Ryuk and LockerGoga Ransomware
LockerGoga Ryuk FIN6
2019-04-02HelpNetSecurityZeljka Zorz
@online{zorz:20190402:lockergoga:7fe224d, author = {Zeljka Zorz}, title = {{A LockerGoga primer and decrypters for Mira and Aurora ransomwares}}, date = {2019-04-02}, organization = {HelpNetSecurity}, url = {https://www.helpnetsecurity.com/2019/04/02/aurora-decrypter-mira-decrypter/}, language = {English}, urldate = {2019-12-16} } A LockerGoga primer and decrypters for Mira and Aurora ransomwares
LockerGoga
2019-03-21DoublePulsarKevin Beaumont
@online{beaumont:20190321:how:ecfbbf1, author = {Kevin Beaumont}, title = {{How Lockergoga took down Hydro — ransomware used in targeted attacks aimed at big business}}, date = {2019-03-21}, organization = {DoublePulsar}, url = {https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880}, language = {English}, urldate = {2019-11-29} } How Lockergoga took down Hydro — ransomware used in targeted attacks aimed at big business
LockerGoga
2019-01-30Bleeping ComputerIonut Ilascu
@online{ilascu:20190130:new:5c2d8da, author = {Ionut Ilascu}, title = {{New LockerGoga Ransomware Allegedly Used in Altran Attack}}, date = {2019-01-30}, organization = {Bleeping Computer}, url = {https://www.bleepingcomputer.com/news/security/new-lockergoga-ransomware-allegedly-used-in-altran-attack/}, language = {English}, urldate = {2019-12-20} } New LockerGoga Ransomware Allegedly Used in Altran Attack
LockerGoga
Yara Rules
[TLP:WHITE] win_lockergoga_auto (20200817 | autogenerated rule brought to you by yara-signator)
rule win_lockergoga_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2020-08-17"
        version = "1"
        description = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.4.0"
        tool_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lockergoga"
        malpedia_rule_date = "20200817"
        malpedia_hash = "8c895fd01eccb47a6225bcb1a3ba53cbb98644c5"
        malpedia_version = "20200817"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using yara-signator.
     * The code and documentation / approach is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { eb33 83fb20 7707 b820000000 eb27 83fb40 7707 }
            // n = 7, score = 400
            //   eb33                 | jmp                 0x35
            //   83fb20               | cmp                 ebx, 0x20
            //   7707                 | ja                  9
            //   b820000000           | mov                 eax, 0x20
            //   eb27                 | jmp                 0x29
            //   83fb40               | cmp                 ebx, 0x40
            //   7707                 | ja                  9

        $sequence_1 = { a1???????? 33c5 50 8d45f4 64a300000000 6a01 c745fc00000000 }
            // n = 7, score = 400
            //   a1????????           |                     
            //   33c5                 | xor                 eax, ebp
            //   50                   | push                eax
            //   8d45f4               | lea                 eax, [ebp - 0xc]
            //   64a300000000         | mov                 dword ptr fs:[0], eax
            //   6a01                 | push                1
            //   c745fc00000000       | mov                 dword ptr [ebp - 4], 0

        $sequence_2 = { 8b4004 8b0c88 8b04da 8904f1 8b44da04 8b5df0 8b55f8 }
            // n = 7, score = 400
            //   8b4004               | mov                 eax, dword ptr [eax + 4]
            //   8b0c88               | mov                 ecx, dword ptr [eax + ecx*4]
            //   8b04da               | mov                 eax, dword ptr [edx + ebx*8]
            //   8904f1               | mov                 dword ptr [ecx + esi*8], eax
            //   8b44da04             | mov                 eax, dword ptr [edx + ebx*8 + 4]
            //   8b5df0               | mov                 ebx, dword ptr [ebp - 0x10]
            //   8b55f8               | mov                 edx, dword ptr [ebp - 8]

        $sequence_3 = { a801 7408 8d4dd8 e8???????? 8bc6 8b4df4 64890d00000000 }
            // n = 7, score = 400
            //   a801                 | test                al, 1
            //   7408                 | je                  0xa
            //   8d4dd8               | lea                 ecx, [ebp - 0x28]
            //   e8????????           |                     
            //   8bc6                 | mov                 eax, esi
            //   8b4df4               | mov                 ecx, dword ptr [ebp - 0xc]
            //   64890d00000000       | mov                 dword ptr fs:[0], ecx

        $sequence_4 = { eb07 c745cc02000000 8b45f8 8b4008 2b45cc 8945bc }
            // n = 6, score = 400
            //   eb07                 | jmp                 9
            //   c745cc02000000       | mov                 dword ptr [ebp - 0x34], 2
            //   8b45f8               | mov                 eax, dword ptr [ebp - 8]
            //   8b4008               | mov                 eax, dword ptr [eax + 8]
            //   2b45cc               | sub                 eax, dword ptr [ebp - 0x34]
            //   8945bc               | mov                 dword ptr [ebp - 0x44], eax

        $sequence_5 = { 4f 49 8bc7 c1e802 23c8 8d1c8d00000000 8b4e04 }
            // n = 7, score = 400
            //   4f                   | dec                 edi
            //   49                   | dec                 ecx
            //   8bc7                 | mov                 eax, edi
            //   c1e802               | shr                 eax, 2
            //   23c8                 | and                 ecx, eax
            //   8d1c8d00000000       | lea                 ebx, [ecx*4]
            //   8b4e04               | mov                 ecx, dword ptr [esi + 4]

        $sequence_6 = { 8b4dfc 6a01 6a00 8b02 53 ff7130 8bca }
            // n = 7, score = 400
            //   8b4dfc               | mov                 ecx, dword ptr [ebp - 4]
            //   6a01                 | push                1
            //   6a00                 | push                0
            //   8b02                 | mov                 eax, dword ptr [edx]
            //   53                   | push                ebx
            //   ff7130               | push                dword ptr [ecx + 0x30]
            //   8bca                 | mov                 ecx, edx

        $sequence_7 = { ff7508 8bf9 8b4710 8d4f10 ff5020 8b5748 8d7738 }
            // n = 7, score = 400
            //   ff7508               | push                dword ptr [ebp + 8]
            //   8bf9                 | mov                 edi, ecx
            //   8b4710               | mov                 eax, dword ptr [edi + 0x10]
            //   8d4f10               | lea                 ecx, [edi + 0x10]
            //   ff5020               | call                dword ptr [eax + 0x20]
            //   8b5748               | mov                 edx, dword ptr [edi + 0x48]
            //   8d7738               | lea                 esi, [edi + 0x38]

        $sequence_8 = { c745fc00000000 c7462000000000 c7464000000000 8b4508 c645fc02 3bf0 740d }
            // n = 7, score = 400
            //   c745fc00000000       | mov                 dword ptr [ebp - 4], 0
            //   c7462000000000       | mov                 dword ptr [esi + 0x20], 0
            //   c7464000000000       | mov                 dword ptr [esi + 0x40], 0
            //   8b4508               | mov                 eax, dword ptr [ebp + 8]
            //   c645fc02             | mov                 byte ptr [ebp - 4], 2
            //   3bf0                 | cmp                 esi, eax
            //   740d                 | je                  0xf

        $sequence_9 = { 8bc7 ba01000000 2bc1 3bc2 0f42d0 837dd010 8d45bc }
            // n = 7, score = 400
            //   8bc7                 | mov                 eax, edi
            //   ba01000000           | mov                 edx, 1
            //   2bc1                 | sub                 eax, ecx
            //   3bc2                 | cmp                 eax, edx
            //   0f42d0               | cmovb               edx, eax
            //   837dd010             | cmp                 dword ptr [ebp - 0x30], 0x10
            //   8d45bc               | lea                 eax, [ebp - 0x44]

    condition:
        7 of them and filesize < 2588672
}
[TLP:WHITE] win_lockergoga_w0   (20190320 | Detects LockerGoga ransomware binaries)
rule win_lockergoga_w0 {   
    meta:   
        description = "Detects LockerGoga ransomware binaries"   
        author = "Florian Roth"   
        reference = "https://www.nrk.no/norge/skreddersydd-dobbeltangrep-mot-hydro-1.14480202"   
        license = "https://creativecommons.org/licenses/by-nc/4.0/"   
        date = "2019-03-19"   
        hash1 = "c97d9bbc80b573bdeeda3812f4d00e5183493dd0d5805e2508728f65977dda15"   
        hash2 = "7bcd69b3085126f7e97406889f78ab74e87230c11812b79406d723a80c08dd26"   
        hash3 = "bdf36127817413f625d2625d3133760af724d6ad2410bea7297ddc116abc268f"   
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lockergoga"
        malpedia_version = "20190320"
        malpedia_license = "CC BY-NC-SA 4.0"
        malpedia_sharing = "TLP:WHITE"
    strings:   
        $x1 = "\\.(doc|dot|wbk|docx|dotx|docb|xlm|xlsx|xltx|xlsb|xlw|ppt|pot|pps|pptx|potx|ppsx|sldx|pdf)" wide   
        $x2 = "|[A-Za-z]:\\cl.log" wide   
        $x4 = "\\crypto-locker\\" ascii   
        $xc1 = { 00 43 00 6F 00 6D 00 70 00 61 00 6E 00 79 00 4E   
          00 61 00 6D 00 65 00 00 00 00 00 4D 00 6C 00 63   
          00 72 00 6F 00 73 00 6F 00 66 00 74 }   
        $xc2 = { 00 2E 00 6C 00 6F 00 63 00 6B 00 65 00 64 00 00   
          00 20 46 41 49 4C 45 44 20 00 00 00 00 20 00 00   
          00 20 75 6E 6B 6E 6F 77 6E 20 65 78 63 65 70 74   
          69 6F 6E }   
        $rn1 = "This may lead to the impossibility of recovery of the certain files." wide   
    condition:   
        1 of ($x*) or $rn1
}
Download all Yara Rules