Search

startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run Locky = "%User Temp%\svchost.exe" (Note: This registry entry is deleted after encryption of all files) Other System Modifications

RANSOM_LOCKY.AN

renames the encrypted files to {unique ID per victim}{identifier}.locky It adds the following registry keys: HKEY_CURRENT_USER\Software\Locky It adds the following registry entries as part of its

RANSOM_LOCKY.AB

startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run Locky = "%User Temp%\svchost.exe" (Note: This is deleted after encryption of all files) Other System Modifications This Trojan

WORM_DROKBOT.HWR

{7209F5A7-047B-4D4C-9F8A-3A6AE938F17C}\RP1\snapshot\Repository\$WinMgmt.CFG %System Root%\System Volume Information\_restore{7209F5A7-047B-4D4C-9F8A-3A6AE938F17C}\RP1\snapshot\Repository\FS\INDEX.BTR %System Root%\System Volume

Ransom_LOCKY.A

\ Windows\CurrentVersion\Run Locky = "%User Temp%\svchost.exe" (Note: This registry entry is deleted after encryption of all files) Other System Modifications This Trojan modifies the following file(s): It

RANSOM_LOCKY.B

startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run Locky = "%User Temp%\svchost.exe" (Note: This is deleted after encryption of all files) Other System Modifications This Trojan

RANSOM_LOCKY.JA

visiting malicious sites. Other System Modifications This Trojan adds the following registry keys: HKEY_CURRENT_USER\Software\Locky It adds the following registry entries: HKEY_CURRENT_USER\Software\Locky id

RANSOM_LOCKY.C

startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run Locky = "%User Temp%\svchost.exe" (Note: This is deleted after encryption of all files) Other System Modifications This Trojan

PUA.Win32.PCSpeedCat.K

This Potentially Unwanted Application arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. Arrival Details This

RANSOM_LOCKY.AZ

to {unique ID per victim}{identifier}.locky It adds the following registry keys: HKEY_CURRENT_USER\Software\Locky It adds the following registry entries as part of its installation routine:

TROJ_DELALL.K

\snapshot\Repository\FS\INDEX.BTR %System Root%\System Volume Information\_restore{7209F5A7-047B-4D4C-9F8A-3A6AE938F17C}\RP1\snapshot\Repository\FS\INDEX.MAP %System Root%\System Volume Information\_restore

RANSOM_LOCKY.CBQ163T

execution at every system startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run Locky = "%User Temp%\svchost.exe" Other System Modifications This Trojan adds the following registry entries

Ransom_LOCKY.AE