SYMBOLCOMMON_NAMEaka. SYNONYMS
win.locky (Back to overview)

Locky

Actor(s): TA505

VTCollection     URLhaus    

Locky is a high profile ransomware family that first appeared in early 2016 and was observed being active until end of 2017. It encrypts files on the victim system and asks for ransom in order to have back original files. In its first version it added a .locky extension to the encrypted files, and in recent versions it added the .lukitus extension. The ransom amount is defined in BTC and depends on the actor.

References
2021-10-05 ⋅ Trend Micro ⋅ Byron Gelera, Fyodor Yarochkin, Janus Agcaoili, Nikko Tamana
Ransomware as a Service: Enabler of Widespread Attacks
Cerber Conti DarkSide Gandcrab Locky Nefilim REvil Ryuk
2020-08-20 ⋅ CERT-FR ⋅ CERT-FR
Development of the Activity of the TA505 Cybercriminal Group
AndroMut Bart Clop Dridex FlawedAmmyy FlawedGrace Get2 Locky Marap QuantLoader SDBbot ServHelper tRat TrickBot
2020-07-29 ⋅ ESET Research ⋅ welivesecurity
THREAT REPORT Q2 2020
DEFENSOR ID HiddenAd Bundlore Pirrit Agent.BTZ Cerber ClipBanker CROSSWALK Cryptowall CTB Locker DanaBot Dharma Formbook Gandcrab Grandoreiro Houdini ISFB LockBit Locky Mailto Maze Microcin Nemty NjRAT Phobos PlugX Pony REvil Socelars STOP Tinba TrickBot WannaCryptor
2020-06-22 ⋅ ⋅ CERT-FR ⋅ CERT-FR
Évolution De Lactivité du Groupe Cybercriminel TA505
Amadey AndroMut Bart Clop Dridex FlawedGrace Gandcrab Get2 GlobeImposter Jaff Locky Marap Philadephia Ransom QuantLoader Scarab Ransomware SDBbot ServHelper Silence tRat TrickBot
2020-05-21 ⋅ Intel 471 ⋅ Intel 471
A brief history of TA505
AndroMut Bart Dridex FlawedAmmyy FlawedGrace Gandcrab Get2 GlobeImposter Jaff Kegotip Locky Necurs Philadephia Ransom Pony QuantLoader Rockloader SDBbot ServHelper Shifu Snatch TrickBot
2020-05-18 ⋅ Threatpost ⋅ Tara Seals
Ransomware Gang Arrested for Spreading Locky to Hospitals
Locky
2020-02-10 ⋅ viXra ⋅ Jason Reaves
A Case Study into solving Crypters/Packers in Malware Obfuscation using an SMT approach
Locky
2019-09-09 ⋅ McAfee ⋅ Chintan Shah, Marc Rivero López, Thomas Roccia
Evolution of Malware Sandbox Evasion Tactics – A Retrospective Study
Cutwail Dridex Dyre Kovter Locky Phorpiex Simda
2019-07-30 ⋅ Dissecting Malware ⋅ Marius Genheimer
Picking Locky
Locky
2018-07-26 ⋅ IEEE Symposium on Security and Privacy (SP) ⋅ Alex C. Snoeren, Damon McCoy, Danny Yuxing Huang, Elie Bursztein, Jonathan Levin, Kirill Levchenko, Kylie McRoberts, Luca Invernizzi, Maxwell Matthaios Aliapoulios, Vector Guo Li
Tracking Ransomware End-to-end
Cerber Locky WannaCryptor
2018-03-20 ⋅ Stormshield ⋅ Mehdi Talbi
De-obfuscating Jump Chains with Binary Ninja
Locky
2017-11-07 ⋅ ThreatVector ⋅ Cylance Threat Research Team
Locky Ransomware
Locky
2017-08-20 ⋅ MyOnlineSecurity ⋅ MyOnlineSecurity
return of fake UPS cannot deliver malspam with an updated nemucod ransomware and Kovter payload
Cold$eal Locky
2017-08-16 ⋅ Bleeping Computer ⋅ Lawrence Abrams
Locky Ransomware switches to the Lukitus extension for Encrypted Files
Locky
2017-08-10 ⋅ ⋅ botfrei Blog ⋅ Tom Berchem
Weltweite Spamwelle verbreitet teuflische Variante des Locky
Locky
2017-07-18 ⋅ Elastic ⋅ Ashkan Hosseini
Ten process injection techniques: A technical survey of common and trending process injection techniques
Cryakl CyberGate Dridex FinFisher RAT Locky
2017-06-22 ⋅ Bleeping Computer ⋅ Catalin Cimpanu
Locky Ransomware Returns, but Targets Only Windows XP & Vista
Locky
2017-06-21 ⋅ Cisco ⋅ Alex Chiu, Jaeson Schultz, Matthew Molyett, Sean Baird, Warren Mercer
Player 1 Limps Back Into the Ring - Hello again, Locky!
Locky
2017-01-31 ⋅ Malwarebytes ⋅ Malwarebytes Labs
Locky Bart ransomware and backend server analysis
Locky
2016-07-07 ⋅ Pierluigi Paganini
New threat dubbed Zepto Ransomware is spreading out with a new email spam campaign. It is a variant of the recent Locky Ransomware.
Locky
2016-03-01 ⋅ Malwarebytes ⋅ hasherezade
Look Into Locky Ransomware
Locky
Yara Rules
[TLP:WHITE] win_locky_auto (20230808 | Detects win.locky.)
rule win_locky_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-12-06"
        version = "1"
        description = "Detects win.locky."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.locky"
        malpedia_rule_date = "20231130"
        malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
        malpedia_version = "20230808"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 89b560ffffff 898568ffffff ffd7 8bf8 897de0 3bfb }
            // n = 6, score = 2100
            //   89b560ffffff         | mov                 dword ptr [ebp - 0xa0], esi
            //   898568ffffff         | mov                 dword ptr [ebp - 0x98], eax
            //   ffd7                 | call                edi
            //   8bf8                 | mov                 edi, eax
            //   897de0               | mov                 dword ptr [ebp - 0x20], edi
            //   3bfb                 | cmp                 edi, ebx

        $sequence_1 = { 8b4db8 3975cc 7303 8d4db8 8b45d4 3975e8 }
            // n = 6, score = 2100
            //   8b4db8               | mov                 ecx, dword ptr [ebp - 0x48]
            //   3975cc               | cmp                 dword ptr [ebp - 0x34], esi
            //   7303                 | jae                 5
            //   8d4db8               | lea                 ecx, [ebp - 0x48]
            //   8b45d4               | mov                 eax, dword ptr [ebp - 0x2c]
            //   3975e8               | cmp                 dword ptr [ebp - 0x18], esi

        $sequence_2 = { 50 50 50 894de8 8b4d08 }
            // n = 5, score = 2100
            //   50                   | push                eax
            //   50                   | push                eax
            //   50                   | push                eax
            //   894de8               | mov                 dword ptr [ebp - 0x18], ecx
            //   8b4d08               | mov                 ecx, dword ptr [ebp + 8]

        $sequence_3 = { 8d459c 50 8d45b8 50 e8???????? 59 59 }
            // n = 7, score = 2100
            //   8d459c               | lea                 eax, [ebp - 0x64]
            //   50                   | push                eax
            //   8d45b8               | lea                 eax, [ebp - 0x48]
            //   50                   | push                eax
            //   e8????????           |                     
            //   59                   | pop                 ecx
            //   59                   | pop                 ecx

        $sequence_4 = { 46 3bf0 7621 8bc8 d1e9 ba49922409 }
            // n = 6, score = 2100
            //   46                   | inc                 esi
            //   3bf0                 | cmp                 esi, eax
            //   7621                 | jbe                 0x23
            //   8bc8                 | mov                 ecx, eax
            //   d1e9                 | shr                 ecx, 1
            //   ba49922409           | mov                 edx, 0x9249249

        $sequence_5 = { 8bc6 03c1 3810 7412 83ff10 7204 }
            // n = 6, score = 2100
            //   8bc6                 | mov                 eax, esi
            //   03c1                 | add                 eax, ecx
            //   3810                 | cmp                 byte ptr [eax], dl
            //   7412                 | je                  0x14
            //   83ff10               | cmp                 edi, 0x10
            //   7204                 | jb                  6

        $sequence_6 = { 837e1410 8b4610 7202 8b36 50 56 8d45f0 }
            // n = 7, score = 2100
            //   837e1410             | cmp                 dword ptr [esi + 0x14], 0x10
            //   8b4610               | mov                 eax, dword ptr [esi + 0x10]
            //   7202                 | jb                  4
            //   8b36                 | mov                 esi, dword ptr [esi]
            //   50                   | push                eax
            //   56                   | push                esi
            //   8d45f0               | lea                 eax, [ebp - 0x10]

        $sequence_7 = { 83c9ff 8bf0 51 e8???????? 40 50 }
            // n = 6, score = 2100
            //   83c9ff               | or                  ecx, 0xffffffff
            //   8bf0                 | mov                 esi, eax
            //   51                   | push                ecx
            //   e8????????           |                     
            //   40                   | inc                 eax
            //   50                   | push                eax

        $sequence_8 = { 03d3 5b c21000 e9???????? 8bff 55 8bec }
            // n = 7, score = 1400
            //   03d3                 | add                 edx, ebx
            //   5b                   | pop                 ebx
            //   c21000               | ret                 0x10
            //   e9????????           |                     
            //   8bff                 | mov                 edi, edi
            //   55                   | push                ebp
            //   8bec                 | mov                 ebp, esp

        $sequence_9 = { 6a44 90 e9???????? 90 }
            // n = 4, score = 700
            //   6a44                 | push                0x44
            //   90                   | nop                 
            //   e9????????           |                     
            //   90                   | nop                 

        $sequence_10 = { 5d 90 ebf6 90 }
            // n = 4, score = 700
            //   5d                   | pop                 ebp
            //   90                   | nop                 
            //   ebf6                 | jmp                 0xfffffff8
            //   90                   | nop                 

        $sequence_11 = { 83c40c e9???????? 90 8d00 }
            // n = 4, score = 700
            //   83c40c               | add                 esp, 0xc
            //   e9????????           |                     
            //   90                   | nop                 
            //   8d00                 | lea                 eax, [eax]

        $sequence_12 = { 66ab e9???????? 90 8d36 }
            // n = 4, score = 700
            //   66ab                 | stosw               word ptr es:[edi], ax
            //   e9????????           |                     
            //   90                   | nop                 
            //   8d36                 | lea                 esi, [esi]

        $sequence_13 = { ff15???????? e9???????? 90 50 90 }
            // n = 5, score = 700
            //   ff15????????         |                     
            //   e9????????           |                     
            //   90                   | nop                 
            //   50                   | push                eax
            //   90                   | nop                 

        $sequence_14 = { 66ab 90 e9???????? 8d36 }
            // n = 4, score = 700
            //   66ab                 | stosw               word ptr es:[edi], ax
            //   90                   | nop                 
            //   e9????????           |                     
            //   8d36                 | lea                 esi, [esi]

        $sequence_15 = { 5e c21000 8bff 55 8bec 33c0 8b4d08 }
            // n = 7, score = 700
            //   5e                   | pop                 esi
            //   c21000               | ret                 0x10
            //   8bff                 | mov                 edi, edi
            //   55                   | push                ebp
            //   8bec                 | mov                 ebp, esp
            //   33c0                 | xor                 eax, eax
            //   8b4d08               | mov                 ecx, dword ptr [ebp + 8]

    condition:
        7 of them and filesize < 1122304
}
Download all Yara Rules