LockyMalware
- locky-odin
- locky-osiris
- locky-osiris 2016
- locky-osiris 2017
Locky is a high profile ransomware family that first appeared in early 2016 and was observed being active until end of 2017. It encrypts files on the victim system and asks for ransom in order to have back original files. In its first version it added a.locky extension to the encrypted files, and in recent versions it added the.lukitus extension.From MISP Galaxy
Last reported 3 years ago, by Elastic Security Labs2 reports
ATT&CK techniques
6 of 8 · each with the sentence it comes from- T1005Data from Local System
“Data from Local System”
- T1027Obfuscated Files or Information
“Obfuscated Files or Information: Dynamic API Resolution”
- T1027.007Dynamic API Resolution
“Dynamic API resolution”
- T1033System Owner/User Discovery
“System Owner/User Discovery”
- T1041Exfiltration Over C2 Channel
“Exfiltration Over C2 Channel”
- T1176.001Browser Extensions
“After the browser extensions are enumerated, there is a check for a hardcoded file titled hmr_*.dat inside the C:\ProgramData directory.”
What the reports say
2 reports, newest first · the exact sentence from each-
Elastic Security Labs discovers the LOBSHOT malware“TA505 is a well-known cybercrime group associated with Dridex, Locky, and Necurs campaigns.”
-
Huntress Service: Ransomware Canaries“From CryptoLocker to Locky to Sodinokibi to Maze, ransomware has been a staple in the hacker-verse for a long time.”
Indicators in its reports
named in the reports above- hxxps://www.amydecke[.]websitein 1 report
- www.amydecke[.]websitein 1 report
- e4ea88887753a936…e27991856bf6in 1 report
- 95.217.125[.]200in 1 report
- hxxps://malpedia.caad.fkie.fraunhofer[.]de/actor/ta505in 1 report
- hxxps://www.malware-traffic-analysis[.]net/2023/01/23/index.htmlin 1 report
Copy these 6 indicators · defanged
Thanks — we review every report.