locky

General

Target

0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537
Size

249KB
Sample

220628-wzkcfadbg7
MD5

1cc0cca4d5d49aba352f4cc93aed3f6f
SHA1

e7db8694074d1a2c7ac097eff4c085debe389d73
SHA256

0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537
SHA512

fa127310e53e2bb80f6ea27574e2a28eddd180df0ce00fe49d53f4ba508550f5100943a4db8ac1a786468acada99fe0b1476b73417d8fa4d0349eb62a390a29e

Score

10^/10

Malware Config

Targets

- Target
  
  0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537
- Size
  
  249KB
- MD5
  
  1cc0cca4d5d49aba352f4cc93aed3f6f
- SHA1
  
  e7db8694074d1a2c7ac097eff4c085debe389d73
- SHA256
  
  0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537
- SHA512
  
  fa127310e53e2bb80f6ea27574e2a28eddd180df0ce00fe49d53f4ba508550f5100943a4db8ac1a786468acada99fe0b1476b73417d8fa4d0349eb62a390a29e
Score

10^/10

locky ransomware suricata adware discovery persistence stealer
- Locky
  Ransomware strain released in 2016, with advanced features like anti-analysis.
  ransomware locky
- suricata: ET MALWARE Locky CnC Checkin HTTP Pattern
  suricata: ET MALWARE Locky CnC Checkin HTTP Pattern
  suricata
- suricata: ET MALWARE Locky CnC checkin Nov 21
  suricata: ET MALWARE Locky CnC checkin Nov 21
  suricata
- Downloads MZ/PE file
- Executes dropped EXE
- Modifies Installed Components in the registry
  persistence
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Registers COM server for autorun
  persistence
- Sets file execution options in registry
  persistence
- Deletes itself
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
- Suspicious use of SetThreadContext
behavioral1 behavioral2