Search

startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run Locky = "%User Temp%\svchost.exe" (Note: This is deleted after encryption of all files) Other System Modifications This Trojan

RANSOM_LOCKY

startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run Locky = "%User Temp%\svchost.exe" (Note: This registry entry is deleted after encryption of all files) Other System Modifications

RANSOM_LOCKY.AN

renames the encrypted files to {unique ID per victim}{identifier}.locky It adds the following registry keys: HKEY_CURRENT_USER\Software\Locky It adds the following registry entries as part of its

WORM_DROKBOT.HWR

{7209F5A7-047B-4D4C-9F8A-3A6AE938F17C}\RP1\snapshot\Repository\$WinMgmt.CFG %System Root%\System Volume Information\_restore{7209F5A7-047B-4D4C-9F8A-3A6AE938F17C}\RP1\snapshot\Repository\FS\INDEX.BTR %System Root%\System Volume

Ransom_LOCKY.A

\ Windows\CurrentVersion\Run Locky = "%User Temp%\svchost.exe" (Note: This registry entry is deleted after encryption of all files) Other System Modifications This Trojan modifies the following file(s): It

RANSOM_LOCKY.C

startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run Locky = "%User Temp%\svchost.exe" (Note: This is deleted after encryption of all files) Other System Modifications This Trojan

RANSOM_LOCKY.B

startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run Locky = "%User Temp%\svchost.exe" (Note: This is deleted after encryption of all files) Other System Modifications This Trojan

RANSOM_LOCKY.JA

visiting malicious sites. Other System Modifications This Trojan adds the following registry keys: HKEY_CURRENT_USER\Software\Locky It adds the following registry entries: HKEY_CURRENT_USER\Software\Locky id

PUA.Win32.PCSpeedCat.K

This Potentially Unwanted Application arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. Arrival Details This

RANSOM_LOCKY.AZ

to {unique ID per victim}{identifier}.locky It adds the following registry keys: HKEY_CURRENT_USER\Software\Locky It adds the following registry entries as part of its installation routine:

TROJ_DELALL.K

\snapshot\Repository\FS\INDEX.BTR %System Root%\System Volume Information\_restore{7209F5A7-047B-4D4C-9F8A-3A6AE938F17C}\RP1\snapshot\Repository\FS\INDEX.MAP %System Root%\System Volume Information\_restore

RANSOM_LOCKY.CBQ163T

execution at every system startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run Locky = "%User Temp%\svchost.exe" Other System Modifications This Trojan adds the following registry entries

BAT_LOCKY.P

This Trojan may be dropped by other malware. It does not have any propagation routine. It does not have any backdoor routine. Arrival Details This Trojan may be dropped by the following malware:

Ransom_LOCKY.AE