Home Malware Programs Ransomware ‘.locky File Extension’ Ransomware

‘.locky File Extension’ Ransomware

Posted: February 16, 2016

Threat Metric

Threat Level: 10/10
Infected PCs: 862
First Seen: February 16, 2016
Last Seen: November 29, 2023
OS(es) Affected: Windows

The '.locky File Extension' Ransomware is a Trojan that uses file encryption-based ransom schemes to extract money from its victims. Countering any file encryptor-based infection requires removing the threat before you take any other actions for restoring any data that might have been damaged by its payload. Besides using anti-malware tools for removing the '.locky File Extension' Ransomware, malware experts always recommend keeping multiple backups for quick and reliable recovery of any damaged files.

The Newest in File Lockdowns for Cash

The '.locky File Extension' Ransomware is a recent file encryptor with no known relatives. Its campaigns have been seen targeting various US companies and organizations through e-mail spam, with the messages disguising themselves as invoices. Opening Word document attachments launch a corrupted macro script, which, in turn, installs the '.locky File Extension' Ransomware. The '.locky File Extension' Ransomware then begins scanning the compromised PC without providing any initial symptoms of its activities.

The '.locky File Extension' Ransomware targets files according to their extension formats, including PDFs, MP3s, and most forms of text documents. Appropriate information is encrypted with a 128-bit AES algorithm, rearranging their structure with the intention of making other programs unable to read them. With its primary payload finished, the '.locky File Extension' Ransomware adds name changes for each file in question, swaps the victim's desktop image to a ransom instruction, and places a duplicate of these instructions on the hard drive in a TXT file.

The '.locky File Extension' Ransomware instructs victims to make payments through a TOR browser-accessed website for the purpose of restoring their files. There is, however, no guarantee of the '.locky File Extension' Ransomware's con artists abiding by their half of the transaction, and malware experts rarely recommend resorting to threat solutions that reward their perpetrators.

Unlocking the Mystery of Protecting Your PC

The '.locky File Extension' Ransomware scans all non-essential folders on local hard drives, doesn't require admin-level privileges, and also may access network-mapped folders that are visited by the PC user. This inclusion makes it particularly important for PC users to protect their data with secure storage methods that can't be overridden by the '.locky File Extension' Ransomware, such as cloud storage or USB devices. Because the '.locky File Extension' Ransomware's campaign is new, only a minority of PC security companies have developed identifying entries for either the '.locky File Extension' Ransomware or the Trojan dropper embedded in its e-mail document.

E-mail invoices are a common tactic used by delivering threats to NGOs, governments and businesses around the world. Always scan these files before opening them, and, if possible, verify the legitimacy of an unknown e-mail attachment before taking the risk of opening it. As in all similar attacks, malware experts can't recommend solutions other than removing the '.locky File Extension' Ransomware with an anti-malware product of your choice, no matter how important your data is to you.

Use SpyHunter to Detect and Remove PC Threats

If you are concerned that malware or PC threats similar to ‘.locky File Extension’ Ransomware may have infected your computer, we recommend you start an in-depth system scan with SpyHunter. SpyHunter is an advanced malware protection and remediation application that offers subscribers a comprehensive method for protecting PCs from malware, in addition to providing one-on-one technical support service.

* See Free Trial offer below. EULA and Privacy/Cookie Policy.

Why can't I open any program including SpyHunter? You may have a malware file running in memory that kills any programs that you try to launch on your PC. Tip: Download SpyHunter from a clean computer, copy it to a USB thumb drive, DVD or CD, then install it on the infected PC and run SpyHunter's malware scanner.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



MRI6219316107.js File name: MRI6219316107.js
Size: 6.24 KB (6248 bytes)
MD5: e66009d3c69f364568d5f0d5dd6ec2d0
Detection count: 93
File type: JavaScript file
Mime Type: unknown/js
Group: Malware file
Last Updated: March 14, 2016
problem.437332391.js File name: problem.437332391.js
Size: 4.05 KB (4052 bytes)
MD5: 34b1de7abb0fca894b13780fc65899eb
Detection count: 92
File type: JavaScript file
Mime Type: unknown/js
Group: Malware file
Last Updated: March 10, 2016
c:\windows\temp\bdcore_tmp\1920\tmp00000088\tmp00124509 File name: tmp00124509
Size: 436.22 KB (436224 bytes)
MD5: 2fbffc7434688a221968eabce01cf406
Detection count: 63
Path: c:\windows\temp\bdcore_tmp\1920\tmp00000088
Group: Malware file
Last Updated: August 19, 2020
%SYSTEMDRIVE%\Users\<username>\Desktop\sssssssssssssssssssssssssssssssssssssssssssss\f689391b0527fbf40d425e1ffb1fafd5c84fa68af790e8cc4093bcc81708c11b File name: f689391b0527fbf40d425e1ffb1fafd5c84fa68af790e8cc4093bcc81708c11b
Size: 620.54 KB (620544 bytes)
MD5: 544bc1c6ecd95d89d96b5e75c3121fea
Detection count: 14
Path: %SYSTEMDRIVE%\Users\<username>\Desktop\sssssssssssssssssssssssssssssssssssssssssssss\f689391b0527fbf40d425e1ffb1fafd5c84fa68af790e8cc4093bcc81708c11b
Group: Malware file
Last Updated: December 18, 2020
C:\Program Files\!Malware-Collection-Part-2-main\Locky.exe File name: Locky.exe
Size: 672.76 KB (672768 bytes)
MD5: 0d0823d9a5d000b80e27090754f59ee5
Detection count: 12
File type: Executable File
Mime Type: unknown/exe
Path: C:\Program Files\!Malware-Collection-Part-2-main\Locky.exe
Group: Malware file
Last Updated: November 29, 2023
c:\Users\<username>\desktop\file.exe File name: file.exe
Size: 201.21 KB (201216 bytes)
MD5: 0ca0d0acc30a746227bc4b5054569d7f
Detection count: 7
File type: Executable File
Mime Type: unknown/exe
Path: c:\Users\<username>\desktop
Group: Malware file
Last Updated: August 3, 2018

More files

Registry Modifications

The following newly produced Registry Values are:

File name without path_Locky_recover_instructions.bmpE65DPaiQc7R.htaRegexp file mask%Temp%\MicroImageDir\_HOWDO_text.bmp%USERPROFILE%\DesktopOSIRIS.bmp
Loading...
Spywareremove.com uses cookies to provide you with a better browsing experience and analyze how users navigate and utilize the Site. By using this Site or clicking on "OK", you consent to the use of cookies. Learn more.