‘.locky File Extension’ Ransomware
Posted: February 16, 2016
Threat Metric
The following fields listed on the Threat Meter containing a specific value, are explained in detail below:
Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.
Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.
Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.
Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.
% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.
| Threat Level: | 10/10 |
|---|---|
| Infected PCs: | 857 |
| First Seen: | February 16, 2016 |
|---|---|
| Last Seen: | October 27, 2021 |
| OS(es) Affected: | Windows |
The '.locky File Extension' Ransomware is a Trojan that uses file encryption-based ransom schemes to extract money from its victims. Countering any file encryptor-based infection requires removing the threat before you take any other actions for restoring any data that might have been damaged by its payload. Besides using anti-malware tools for removing the '.locky File Extension' Ransomware, malware experts always recommend keeping multiple backups for quick and reliable recovery of any damaged files.
The Newest in File Lockdowns for Cash
The '.locky File Extension' Ransomware is a recent file encryptor with no known relatives. Its campaigns have been seen targeting various US companies and organizations through e-mail spam, with the messages disguising themselves as invoices. Opening Word document attachments launch a corrupted macro script, which, in turn, installs the '.locky File Extension' Ransomware. The '.locky File Extension' Ransomware then begins scanning the compromised PC without providing any initial symptoms of its activities.
The '.locky File Extension' Ransomware targets files according to their extension formats, including PDFs, MP3s, and most forms of text documents. Appropriate information is encrypted with a 128-bit AES algorithm, rearranging their structure with the intention of making other programs unable to read them. With its primary payload finished, the '.locky File Extension' Ransomware adds name changes for each file in question, swaps the victim's desktop image to a ransom instruction, and places a duplicate of these instructions on the hard drive in a TXT file.
The '.locky File Extension' Ransomware instructs victims to make payments through a TOR browser-accessed website for the purpose of restoring their files. There is, however, no guarantee of the '.locky File Extension' Ransomware's con artists abiding by their half of the transaction, and malware experts rarely recommend resorting to threat solutions that reward their perpetrators.
Unlocking the Mystery of Protecting Your PC
The '.locky File Extension' Ransomware scans all non-essential folders on local hard drives, doesn't require admin-level privileges, and also may access network-mapped folders that are visited by the PC user. This inclusion makes it particularly important for PC users to protect their data with secure storage methods that can't be overridden by the '.locky File Extension' Ransomware, such as cloud storage or USB devices. Because the '.locky File Extension' Ransomware's campaign is new, only a minority of PC security companies have developed identifying entries for either the '.locky File Extension' Ransomware or the Trojan dropper embedded in its e-mail document.
E-mail invoices are a common tactic used by delivering threats to NGOs, governments and businesses around the world. Always scan these files before opening them, and, if possible, verify the legitimacy of an unknown e-mail attachment before taking the risk of opening it. As in all similar attacks, malware experts can't recommend solutions other than removing the '.locky File Extension' Ransomware with an anti-malware product of your choice, no matter how important your data is to you.
Technical Details
File System Modifications
Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.
The following files were created in the system:file.exe
File name: file.exeSize: 206.78 KB (206780 bytes)
MD5: d2863c69b8e8deac65d27875a2d0edc9
Detection count: 96
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: November 17, 2016
MRI6219316107.js
File name: MRI6219316107.jsSize: 6.24 KB (6248 bytes)
MD5: e66009d3c69f364568d5f0d5dd6ec2d0
Detection count: 93
File type: JavaScript file
Mime Type: unknown/js
Group: Malware file
Last Updated: March 14, 2016
problem.437332391.js
File name: problem.437332391.jsSize: 4.05 KB (4052 bytes)
MD5: 34b1de7abb0fca894b13780fc65899eb
Detection count: 92
File type: JavaScript file
Mime Type: unknown/js
Group: Malware file
Last Updated: March 10, 2016
file.exe
File name: file.exeSize: 619 KB (619008 bytes)
MD5: b2753d4292bb12272d8e5cb00242bc5a
Detection count: 80
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: August 29, 2017
c:\windows\temp\bdcore_tmp\1920\tmp00000088\tmp00124509
File name: tmp00124509Size: 436.22 KB (436224 bytes)
MD5: 2fbffc7434688a221968eabce01cf406
Detection count: 63
Path: c:\windows\temp\bdcore_tmp\1920\tmp00000088
Group: Malware file
Last Updated: August 19, 2020
file.exe
File name: file.exeSize: 38.91 KB (38912 bytes)
MD5: c325dcf4c6c1e2b62a7c5b1245985083
Detection count: 55
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: April 25, 2016
file.exe
File name: file.exeSize: 224.7 KB (224703 bytes)
MD5: bf432becfc993d0bec4fabeff48b1292
Detection count: 53
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: December 1, 2016
file.exe
File name: file.exeSize: 26.95 KB (26955 bytes)
MD5: 7c31e5040c3d22f0d5fd89b4ff9c10db
Detection count: 52
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: March 10, 2021
%APPDATA%\Nwiz.dll
File name: Nwiz.dllSize: 57.34 KB (57344 bytes)
MD5: 47071fa53f96afad764ab149b2d2fea6
Detection count: 49
File type: Dynamic link library
Mime Type: unknown/dll
Path: %APPDATA%
Group: Malware file
Last Updated: June 4, 2016
file.exe
File name: file.exeSize: 201.86 KB (201865 bytes)
MD5: 8581787782f6647b506cfe5eac136477
Detection count: 44
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: October 25, 2016
file.exe
File name: file.exeSize: 37.88 KB (37888 bytes)
MD5: ebf1f8951ec79f2e6bf40e6981c7dbfc
Detection count: 42
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: April 25, 2016
file.exe
File name: file.exeSize: 37.88 KB (37888 bytes)
MD5: c5ad81d8d986c92f90d0462bc06ac9c6
Detection count: 41
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: April 25, 2016
file.exe
File name: file.exeSize: 39.42 KB (39424 bytes)
MD5: b0ca8c5881c1d27684c23db7a88d11e1
Detection count: 33
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: April 25, 2016
file.exe
File name: file.exeSize: 606.2 KB (606208 bytes)
MD5: 899ba682505dcbbecaa42f5bbd7ea639
Detection count: 31
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: October 13, 2017
%SYSTEMDRIVE%\Users\<username>\Desktop\sssssssssssssssssssssssssssssssssssssssssssss\f689391b0527fbf40d425e1ffb1fafd5c84fa68af790e8cc4093bcc81708c11b
File name: f689391b0527fbf40d425e1ffb1fafd5c84fa68af790e8cc4093bcc81708c11bSize: 620.54 KB (620544 bytes)
MD5: 544bc1c6ecd95d89d96b5e75c3121fea
Detection count: 14
Path: %SYSTEMDRIVE%\Users\<username>\Desktop\sssssssssssssssssssssssssssssssssssssssssssss\f689391b0527fbf40d425e1ffb1fafd5c84fa68af790e8cc4093bcc81708c11b
Group: Malware file
Last Updated: December 18, 2020
file.exe
File name: file.exeSize: 672.76 KB (672768 bytes)
MD5: 0d0823d9a5d000b80e27090754f59ee5
Detection count: 12
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: August 10, 2017
file.exe
File name: file.exeSize: 255.19 KB (255192 bytes)
MD5: b61684edf1843503106cf5b900813eaf
Detection count: 11
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: November 17, 2016
c:\Users\<username>\desktop\file.exe
File name: file.exeSize: 201.21 KB (201216 bytes)
MD5: 0ca0d0acc30a746227bc4b5054569d7f
Detection count: 7
File type: Executable File
Mime Type: unknown/exe
Path: c:\Users\<username>\desktop
Group: Malware file
Last Updated: August 3, 2018
file.exe
File name: file.exeSize: 673.28 KB (673280 bytes)
MD5: 85875718160f86a6b2a50befab250f43
Detection count: 5
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: April 6, 2022
file.exe
File name: file.exeSize: 630.78 KB (630784 bytes)
MD5: 20f2ca720cb4dcca9195113f258ca4ef
Detection count: 1
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: September 19, 2017
Registry Modifications
File name without path_Locky_recover_instructions.bmpE65DPaiQc7R.htaRegexp file mask%Temp%\MicroImageDir\_HOWDO_text.bmp%USERPROFILE%\DesktopOSIRIS.bmp
Leave a Reply
Please note that we are not able to assist with billing and support issues regarding SpyHunter or other products. If you're having issues with SpyHunter, please get in touch with SpyHunter customer support through your SpyHunter . If you have SpyHunter billing questions, we recommend you check the Billing FAQ. For general suggestions or feedback, contact us.