Home Malware Programs Ransomware ‘.locky File Extension’ Ransomware

‘.locky File Extension’ Ransomware

Posted: February 16, 2016

Threat Metric

Threat Level: 10/10
Infected PCs: 857
First Seen: February 16, 2016
Last Seen: October 27, 2021
OS(es) Affected: Windows

The '.locky File Extension' Ransomware is a Trojan that uses file encryption-based ransom schemes to extract money from its victims. Countering any file encryptor-based infection requires removing the threat before you take any other actions for restoring any data that might have been damaged by its payload. Besides using anti-malware tools for removing the '.locky File Extension' Ransomware, malware experts always recommend keeping multiple backups for quick and reliable recovery of any damaged files.

The Newest in File Lockdowns for Cash

The '.locky File Extension' Ransomware is a recent file encryptor with no known relatives. Its campaigns have been seen targeting various US companies and organizations through e-mail spam, with the messages disguising themselves as invoices. Opening Word document attachments launch a corrupted macro script, which, in turn, installs the '.locky File Extension' Ransomware. The '.locky File Extension' Ransomware then begins scanning the compromised PC without providing any initial symptoms of its activities.

The '.locky File Extension' Ransomware targets files according to their extension formats, including PDFs, MP3s, and most forms of text documents. Appropriate information is encrypted with a 128-bit AES algorithm, rearranging their structure with the intention of making other programs unable to read them. With its primary payload finished, the '.locky File Extension' Ransomware adds name changes for each file in question, swaps the victim's desktop image to a ransom instruction, and places a duplicate of these instructions on the hard drive in a TXT file.

The '.locky File Extension' Ransomware instructs victims to make payments through a TOR browser-accessed website for the purpose of restoring their files. There is, however, no guarantee of the '.locky File Extension' Ransomware's con artists abiding by their half of the transaction, and malware experts rarely recommend resorting to threat solutions that reward their perpetrators.

Unlocking the Mystery of Protecting Your PC

The '.locky File Extension' Ransomware scans all non-essential folders on local hard drives, doesn't require admin-level privileges, and also may access network-mapped folders that are visited by the PC user. This inclusion makes it particularly important for PC users to protect their data with secure storage methods that can't be overridden by the '.locky File Extension' Ransomware, such as cloud storage or USB devices. Because the '.locky File Extension' Ransomware's campaign is new, only a minority of PC security companies have developed identifying entries for either the '.locky File Extension' Ransomware or the Trojan dropper embedded in its e-mail document.

E-mail invoices are a common tactic used by delivering threats to NGOs, governments and businesses around the world. Always scan these files before opening them, and, if possible, verify the legitimacy of an unknown e-mail attachment before taking the risk of opening it. As in all similar attacks, malware experts can't recommend solutions other than removing the '.locky File Extension' Ransomware with an anti-malware product of your choice, no matter how important your data is to you.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



file.exe File name: file.exe
Size: 206.78 KB (206780 bytes)
MD5: d2863c69b8e8deac65d27875a2d0edc9
Detection count: 96
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: November 17, 2016
MRI6219316107.js File name: MRI6219316107.js
Size: 6.24 KB (6248 bytes)
MD5: e66009d3c69f364568d5f0d5dd6ec2d0
Detection count: 93
File type: JavaScript file
Mime Type: unknown/js
Group: Malware file
Last Updated: March 14, 2016
problem.437332391.js File name: problem.437332391.js
Size: 4.05 KB (4052 bytes)
MD5: 34b1de7abb0fca894b13780fc65899eb
Detection count: 92
File type: JavaScript file
Mime Type: unknown/js
Group: Malware file
Last Updated: March 10, 2016
file.exe File name: file.exe
Size: 619 KB (619008 bytes)
MD5: b2753d4292bb12272d8e5cb00242bc5a
Detection count: 80
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: August 29, 2017
c:\windows\temp\bdcore_tmp\1920\tmp00000088\tmp00124509 File name: tmp00124509
Size: 436.22 KB (436224 bytes)
MD5: 2fbffc7434688a221968eabce01cf406
Detection count: 63
Path: c:\windows\temp\bdcore_tmp\1920\tmp00000088
Group: Malware file
Last Updated: August 19, 2020
file.exe File name: file.exe
Size: 38.91 KB (38912 bytes)
MD5: c325dcf4c6c1e2b62a7c5b1245985083
Detection count: 55
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: April 25, 2016
file.exe File name: file.exe
Size: 224.7 KB (224703 bytes)
MD5: bf432becfc993d0bec4fabeff48b1292
Detection count: 53
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: December 1, 2016
file.exe File name: file.exe
Size: 26.95 KB (26955 bytes)
MD5: 7c31e5040c3d22f0d5fd89b4ff9c10db
Detection count: 52
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: March 10, 2021
%APPDATA%\Nwiz.dll File name: Nwiz.dll
Size: 57.34 KB (57344 bytes)
MD5: 47071fa53f96afad764ab149b2d2fea6
Detection count: 49
File type: Dynamic link library
Mime Type: unknown/dll
Path: %APPDATA%
Group: Malware file
Last Updated: June 4, 2016
file.exe File name: file.exe
Size: 201.86 KB (201865 bytes)
MD5: 8581787782f6647b506cfe5eac136477
Detection count: 44
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: October 25, 2016
file.exe File name: file.exe
Size: 37.88 KB (37888 bytes)
MD5: ebf1f8951ec79f2e6bf40e6981c7dbfc
Detection count: 42
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: April 25, 2016
file.exe File name: file.exe
Size: 37.88 KB (37888 bytes)
MD5: c5ad81d8d986c92f90d0462bc06ac9c6
Detection count: 41
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: April 25, 2016
file.exe File name: file.exe
Size: 39.42 KB (39424 bytes)
MD5: b0ca8c5881c1d27684c23db7a88d11e1
Detection count: 33
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: April 25, 2016
file.exe File name: file.exe
Size: 606.2 KB (606208 bytes)
MD5: 899ba682505dcbbecaa42f5bbd7ea639
Detection count: 31
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: October 13, 2017
%SYSTEMDRIVE%\Users\<username>\Desktop\sssssssssssssssssssssssssssssssssssssssssssss\f689391b0527fbf40d425e1ffb1fafd5c84fa68af790e8cc4093bcc81708c11b File name: f689391b0527fbf40d425e1ffb1fafd5c84fa68af790e8cc4093bcc81708c11b
Size: 620.54 KB (620544 bytes)
MD5: 544bc1c6ecd95d89d96b5e75c3121fea
Detection count: 14
Path: %SYSTEMDRIVE%\Users\<username>\Desktop\sssssssssssssssssssssssssssssssssssssssssssss\f689391b0527fbf40d425e1ffb1fafd5c84fa68af790e8cc4093bcc81708c11b
Group: Malware file
Last Updated: December 18, 2020
file.exe File name: file.exe
Size: 672.76 KB (672768 bytes)
MD5: 0d0823d9a5d000b80e27090754f59ee5
Detection count: 12
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: August 10, 2017
file.exe File name: file.exe
Size: 255.19 KB (255192 bytes)
MD5: b61684edf1843503106cf5b900813eaf
Detection count: 11
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: November 17, 2016
c:\Users\<username>\desktop\file.exe File name: file.exe
Size: 201.21 KB (201216 bytes)
MD5: 0ca0d0acc30a746227bc4b5054569d7f
Detection count: 7
File type: Executable File
Mime Type: unknown/exe
Path: c:\Users\<username>\desktop
Group: Malware file
Last Updated: August 3, 2018
file.exe File name: file.exe
Size: 673.28 KB (673280 bytes)
MD5: 85875718160f86a6b2a50befab250f43
Detection count: 5
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: April 6, 2022
file.exe File name: file.exe
Size: 630.78 KB (630784 bytes)
MD5: 20f2ca720cb4dcca9195113f258ca4ef
Detection count: 1
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: September 19, 2017

Registry Modifications

The following newly produced Registry Values are:

File name without path_Locky_recover_instructions.bmpE65DPaiQc7R.htaRegexp file mask%Temp%\MicroImageDir\_HOWDO_text.bmp%USERPROFILE%\DesktopOSIRIS.bmp
Loading...