locky_lukitus | 3329641a171508fa6b1ad7674b31431093d46be190d1a51acd77e486f42d9c8e | Triage

Sharing

General

Target

3329641a171508fa6b1ad7674b31431093d46be190d1a51acd77e486f42d9c8e
Size

600KB
Sample

241018-wnpssa1anf
MD5

1720b1748ad7b8ac0bfc1c3636fead95
SHA1

97bae63417df5bde4a05cd44c6c523db50f6ab76
SHA256

3329641a171508fa6b1ad7674b31431093d46be190d1a51acd77e486f42d9c8e
SHA512

36d1f098c9ef9a80b42ad058c2a86e5cee794d12f74e479a79059197b82c847d8f88b256f17e2276fc0a9e21cf9b3210c563017d03d9c4ff3638484190a16b76
SSDEEP

12288:aKVWGHUsNNXxgAQWE9J4TyP5SqWiboPZnVXDsm:/UANB/Q7wqWicLXD

Score

10^/10

locky_lukitus defense_evasion discovery ransomware

Malware Config

Targets

- Target
  
  3329641a171508fa6b1ad7674b31431093d46be190d1a51acd77e486f42d9c8e
- Size
  
  600KB
- MD5
  
  1720b1748ad7b8ac0bfc1c3636fead95
- SHA1
  
  97bae63417df5bde4a05cd44c6c523db50f6ab76
- SHA256
  
  3329641a171508fa6b1ad7674b31431093d46be190d1a51acd77e486f42d9c8e
- SHA512
  
  36d1f098c9ef9a80b42ad058c2a86e5cee794d12f74e479a79059197b82c847d8f88b256f17e2276fc0a9e21cf9b3210c563017d03d9c4ff3638484190a16b76
- SSDEEP
  
  12288:aKVWGHUsNNXxgAQWE9J4TyP5SqWiboPZnVXDsm:/UANB/Q7wqWicLXD
Score

10^/10

locky_lukitus defense_evasion discovery ransomware
- Locky (Lukitus variant)
  Variant of the Locky ransomware seen in the wild since late 2017.
  ransomware locky_lukitus
- Deletes itself
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

File Deletion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

Tasks

static1

behavioral1

locky_lukitusdefense_evasiondiscoveryransomware

behavioral2