‘.locky File Extension’ Ransomware

‘.locky File Extension’ Ransomware Description

The '.locky File Extension' Ransomware is a Trojan that uses file encryption-based ransom schemes to extract money from its victims. Countering any file encryptor-based infection requires removing the threat before you take any other actions for restoring any data that might have been damaged by its payload. Besides using anti-malware tools for removing the '.locky File Extension' Ransomware, malware experts always recommend keeping multiple backups for quick and reliable recovery of any damaged files.

The Newest in File Lockdowns for Cash

The '.locky File Extension' Ransomware is a recent file encryptor with no known relatives. Its campaigns have been seen targeting various US companies and organizations through e-mail spam, with the messages disguising themselves as invoices. Opening Word document attachments launch a corrupted macro script, which, in turn, installs the '.locky File Extension' Ransomware. The '.locky File Extension' Ransomware then begins scanning the compromised PC without providing any initial symptoms of its activities.

The '.locky File Extension' Ransomware targets files according to their extension formats, including PDFs, MP3s, and most forms of text documents. Appropriate information is encrypted with a 128-bit AES algorithm, rearranging their structure with the intention of making other programs unable to read them. With its primary payload finished, the '.locky File Extension' Ransomware adds name changes for each file in question, swaps the victim's desktop image to a ransom instruction, and places a duplicate of these instructions on the hard drive in a TXT file.

The '.locky File Extension' Ransomware instructs victims to make payments through a TOR browser-accessed website for the purpose of restoring their files. There is, however, no guarantee of the '.locky File Extension' Ransomware's con artists abiding by their half of the transaction, and malware experts rarely recommend resorting to threat solutions that reward their perpetrators.

Unlocking the Mystery of Protecting Your PC

The '.locky File Extension' Ransomware scans all non-essential folders on local hard drives, doesn't require admin-level privileges, and also may access network-mapped folders that are visited by the PC user. This inclusion makes it particularly important for PC users to protect their data with secure storage methods that can't be overridden by the '.locky File Extension' Ransomware, such as cloud storage or USB devices. Because the '.locky File Extension' Ransomware's campaign is new, only a minority of PC security companies have developed identifying entries for either the '.locky File Extension' Ransomware or the Trojan dropper embedded in its e-mail document.

E-mail invoices are a common tactic used by delivering threats to NGOs, governments and businesses around the world. Always scan these files before opening them, and, if possible, verify the legitimacy of an unknown e-mail attachment before taking the risk of opening it. As in all similar attacks, malware experts can't recommend solutions other than removing the '.locky File Extension' Ransomware with an anti-malware product of your choice, no matter how important your data is to you.

Use SpyHunter to Detect and Remove PC Threats

If you are concerned that malware or PC threats similar to ‘.locky File Extension’ Ransomware may have infected your computer, we recommend you start an in-depth system scan with SpyHunter. SpyHunter is an advanced malware protection and remediation application that offers subscribers a comprehensive method for protecting PCs from malware, in addition to providing one-on-one technical support service.

Download SpyHunter's Malware Scanner

Note: SpyHunter's free version is only for malware detection. If SpyHunter detects malware on your PC, you will need to purchase SpyHunter's malware tool to remove the malware threats. Learn more on SpyHunter. If you would like to uninstall SpyHunter for any reason, please follow these uninstall instructions. To learn more about our policies and practices, visit our EULA, Privacy Policy and Threat Assessment Criteria.

Why can't I open any program including SpyHunter? You may have a malware file running in memory that kills any programs that you try to launch on your PC. Tip: Download SpyHunter from a clean computer, copy it to a USB thumb drive, DVD or CD, then install it on the infected PC and run SpyHunter's malware scanner.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



MRI6219316107.js File name: MRI6219316107.js
Size: 6.24 KB (6248 bytes)
MD5: e66009d3c69f364568d5f0d5dd6ec2d0
Detection count: 93
File type: JavaScript file
Mime Type: unknown/js
Group: Malware file
Last Updated: March 14, 2016
problem.437332391.js File name: problem.437332391.js
Size: 4.05 KB (4052 bytes)
MD5: 34b1de7abb0fca894b13780fc65899eb
Detection count: 92
File type: JavaScript file
Mime Type: unknown/js
Group: Malware file
Last Updated: March 10, 2016
%APPDATA%Nwiz.dll File name: Nwiz.dll
Size: 57.34 KB (57344 bytes)
MD5: 47071fa53f96afad764ab149b2d2fea6
Detection count: 49
File type: Dynamic link library
Mime Type: unknown/dll
Path: %APPDATA%
Group: Malware file
Last Updated: June 4, 2016
file.exe File name: file.exe
Size: 39.42 KB (39424 bytes)
MD5: b0ca8c5881c1d27684c23db7a88d11e1
Detection count: 33
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: April 25, 2016

More files

Registry Modifications


The following newly produced Registry Values are:

File name without path_Locky_recover_instructions.bmpE65DPaiQc7R.htaRegexp file mask%Temp%\MicroImageDir\_HOWDO_text.bmp%USERPROFILE%\DesktopOSIRIS.bmp
Posted: February 16, 2016
Threat Metric
Threat Level: 10/10
Infected PCs 670
Home Malware Programs Ransomware ‘.locky File Extension’ Ransomware

Leave a Reply

Please note that we are not able to assist with billing and support issues regarding SpyHunter or other products. If you're having issues with SpyHunter, please get in touch with SpyHunter customer support through your SpyHunter. If you have SpyHunter billing questions, we recommend you check the Billing FAQ. For general suggestions or feedback, contact us.