locky

General

Target

e7c1a11728d5f6c8505967dc12223040743e83ea0c50619fe9fb9daf12e59fcb
Size

243KB
Sample

220628-s5xm6saeaq
MD5

cef4a08ea42c9b66c30de077a2717e04
SHA1

aaf2a7f54b287ee127a5b0be586299c3c516cc70
SHA256

e7c1a11728d5f6c8505967dc12223040743e83ea0c50619fe9fb9daf12e59fcb
SHA512

867d37d458a012b3c6e284ff3aebcb237174581dce92c051b253a3074786cbc49aa4b569021a53e685a0f21975aaaaf69a8359a436216842ab73a15677e8ba69

Score

10^/10

Malware Config

Targets

- Target
  
  e7c1a11728d5f6c8505967dc12223040743e83ea0c50619fe9fb9daf12e59fcb
- Size
  
  243KB
- MD5
  
  cef4a08ea42c9b66c30de077a2717e04
- SHA1
  
  aaf2a7f54b287ee127a5b0be586299c3c516cc70
- SHA256
  
  e7c1a11728d5f6c8505967dc12223040743e83ea0c50619fe9fb9daf12e59fcb
- SHA512
  
  867d37d458a012b3c6e284ff3aebcb237174581dce92c051b253a3074786cbc49aa4b569021a53e685a0f21975aaaaf69a8359a436216842ab73a15677e8ba69
Score

10^/10

locky ransomware suricata adware discovery persistence stealer
- Locky
  Ransomware strain released in 2016, with advanced features like anti-analysis.
  ransomware locky
- suricata: ET MALWARE Ransomware Locky CnC Beacon 21 May
  suricata: ET MALWARE Ransomware Locky CnC Beacon 21 May
  suricata
- Downloads MZ/PE file
- Executes dropped EXE
- Modifies Installed Components in the registry
  persistence
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Registers COM server for autorun
  persistence
- Sets file execution options in registry
  persistence
- Deletes itself
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
- Suspicious use of SetThreadContext
behavioral1 behavioral2