Locky also removes any Volume Snapshot Service (VSS) files, also known as shadow copies, that you may have made. (And you’ll already know how to buy new bitcoins, and how to pay with them.) In other words, if you have more BTCs in your wallet than the cost of the ransom, and no backup, you are very likely to pay up. Locky even scrambles wallet.dat, your Bitcoin wallet file, if you have one. Locky scrambles all files that match a long list of extensions, including videos, images, source code, and Office files. The final payload could be anything, but in this case is usually the Locky Ransomware ( Troj/Ransom-CGW).The saved file ( Troj/Ransom-CGX) serves as a downloader, which fetches the final malware payload from the crooks.If you enable macros, you don’t actually correct the text encoding (that’s a subterfuge) instead, you run code inside the document that saves a file to disk and runs it.The document advises you to enable macros “if the data encoding is incorrect.”.You receive an email containing an attached document ( Troj/DocDl-BCF).The most common way that Locky arrives is as follows: The prices we’ve seen vary from BTC 0.5 to BTC 1.00 (BTC is short for “bitcoin,” where one bitcoin is currently worth about $400/£280). You can buy the decryption key from the crooks via the so-called dark web. Of course, it doesn’t just rename your files, it scrambles them first, and – as you probably know about ransomware – only the crooks have the decryption key. “Locky” feels like quite a cheery-sounding name.īut it’s also the nickname of a new strain of ransomware, so-called because it renames all your important files so that they have the extension. Thanks to the Emerging Threats Team at SophosLabs for their behind-the-scenes work on this article.

Unencrip crypto locker