Locky — MalwareBazaar Mass Analysis (20 samples)

Genel Bakış

Locky, makrolu belgelerle yayıldı.

Malware Türü	Ransomware
Hedef Platform	Windows
Geliştirme Dili	C
C2 Protokolü	HTTP
İlk Görülme	2016

MalwareBazaar İstihbarat Verileri

Analiz Edilen Örnek	20
Zaman Aralığı	2020-04-12 – 2025-03-09
Dosya Türleri	exe(19), dll(1)
Veri Kaynağı	MalwareBazaar (abuse.ch) — kSentinel Otomatik İstihbarat

Hash Örnekleri (İlk 50)

SHA256	MD5	İlk Görülme	Tip	Boyut
f329ea2c754ab196d15c...	7932ee5fa6f83b14...	2025-03-09	dll	163.159
afec2b2af3ace2c47838...	c209817538e86f5e...	2024-10-23	exe	259.072
3329641a171508fa6b1a...	1720b1748ad7b8ac...	2024-05-22	exe	614.400
f2c9ae3735430b930a81...	511aa2f2fe6196e0...	2023-11-20	exe	138.752
d1dcf4c2165f3cf5729b...	22943d9ceda4a911...	2023-08-06	exe	104.448
390ed1dde4ff03adfcf6...	0d0823d9a5d000b8...	2023-06-09	exe	672.768
4bef307f6ffd4f7335ad...	635e527b2f088abe...	2023-05-12	exe	97.792
91eb391fb81353b7bc47...	0ea968f98bd61d06...	2023-05-12	exe	97.792
cfaf5c17b24af5463975...	011ae2b76ac71ffc...	2023-05-12	exe	97.792
a6b93a36b226140c0048...	1238c7d4313505c7...	2023-04-28	exe	131.072
0239a0ffbfd6198ec9fd...	f53f3926c9e319eb...	2023-04-28	exe	245.760
e1de0531f3954d365af9...	2ad5259b79936524...	2023-04-28	exe	110.080
17c3d74e3c0645edb4b5...	fb6ca1cd232151d6...	2023-01-18	exe	184.320
dbb929b5989d63731106...	4cf4a9c9b246071b...	2022-12-22	exe	135.168
0fe7d733494aeb44ed3d...	e39a45a39945294c...	2022-10-08	exe	104.448
49a48d4ff1b7973e55d5...	b66eb4bcb2860ef4...	2021-06-27	exe	162.816
df255af635a2dde04c03...	c24a08bfeb09c984...	2020-06-19	exe	638.464
36350904b065500f429e...	f8dd9bb21344d1b8...	2020-05-12	exe	636.418
ace15d620a4d8a323243...	00201e5ad4e27ff6...	2020-04-13	exe	4.034.560
40a340087cc07780bfd6...	0083da23232ec9e8...	2020-04-12	exe	4.016.640

IOC Özeti

Bu analiz 20 adet benzersiz Locky örneğini kapsar.
Toplam 40 hash IOC kayıt altına alındı.
Kampanya aktivitesi: 2020-04-12 ile 2025-03-09 arasında tespit edildi.

Locky — Malware Profile

Locky, makrolu belgelerle yayıldı.

Malware Type

Ransomware

Programming Language

C2 Protocol

HTTP

Target Systems

Windows

Capabilities & Behavior

Dosya Şifreleme (AES/RSA)

Gölge Kopya Silme

Yedek Kaldırma

Fidye Notu Oluşturma

Kalıcılık Sağlama

Ağ Paylaşımı Şifreleme

Anti-Analiz Teknikleri

Çift Gasp (Data Leak)

IOC List (80 indicators)

IOC — Locky

# SHA256
e1de0531f3954d365af908d2789d453fb12480199fd9bd06a58651f90d926afe 

# SHA256
17c3d74e3c0645edb4b5145335b342d2929c92dff856cca1a5e79fa5d935fec2 

# SHA256
dbb929b5989d63731106f2fc8239debdd23e888d3713ba836b1b357be48e0fb5 

# SHA256
0fe7d733494aeb44ed3dd48f78e3e48f9714fa807f9a09a92cfafa3dc9d6495f 

# SHA256
49a48d4ff1b7973e55d5838f20107620ed808851231256bb94c85f6c80b8ebfc 

# SHA256
df255af635a2dde04c031db95862f11e1bf44fe5cfc10d3b20bd4678ed818567 

# SHA256
36350904b065500f429e6b2af0c4a1ec835352fed15cad40f07760aede4fcd47 

# SHA256
ace15d620a4d8a32324351bd7405307873f7101f113a7e022ed9ec06ee1689b9 

# SHA256
40a340087cc07780bfd61eab92e40f1223a6de88ec191bdedea0b91b16eca2aa 

# SHA256
f329ea2c754ab196d15c20fbf9abd722fa63630631144c5a409bd2a20172196b 

# SHA256
afec2b2af3ace2c478382f9366f6cbc9b9579f2c9a4273150fc33a2ccd59284c 

# SHA256
3329641a171508fa6b1ad7674b31431093d46be190d1a51acd77e486f42d9c8e 

# SHA256
f2c9ae3735430b930a81148c0bb470fcb733e456a2a942f859a1b59c4a7b2150 

# SHA256
d1dcf4c2165f3cf5729ba76e1ee80f4709d8e7eca7a6c29ceffc5fc6b09660fe 

# SHA256
390ed1dde4ff03adfcf67c59ee02567ac5665bb5e029eaebf0332bc81e4d1891 

# SHA256
4bef307f6ffd4f7335adc9a72258c1c196ff2f55b5d422e12505ffcd916b993a 

# SHA256
91eb391fb81353b7bc4794d525997a5dfdbb1d5f1e7e3582e52f8c678adfb900 

# SHA256
cfaf5c17b24af5463975daa676da4291e58ea80e9497df62e2dca2abda0ed681 

# SHA256
a6b93a36b226140c0048811bc07bda4377484857c3207bc37d3b8880da5c6740 

# SHA256
0239a0ffbfd6198ec9fd73a9cac589942939328402884d6d7e03abb5f9e41850 

# SHA256
e1de0531f3954d365af908d2789d453fb12480199fd9bd06a58651f90d926afe 

# SHA256
17c3d74e3c0645edb4b5145335b342d2929c92dff856cca1a5e79fa5d935fec2 

# SHA256
dbb929b5989d63731106f2fc8239debdd23e888d3713ba836b1b357be48e0fb5 

# SHA256
0fe7d733494aeb44ed3dd48f78e3e48f9714fa807f9a09a92cfafa3dc9d6495f 

# SHA256
49a48d4ff1b7973e55d5838f20107620ed808851231256bb94c85f6c80b8ebfc 

# SHA256
df255af635a2dde04c031db95862f11e1bf44fe5cfc10d3b20bd4678ed818567 

# SHA256
36350904b065500f429e6b2af0c4a1ec835352fed15cad40f07760aede4fcd47 

# SHA256
ace15d620a4d8a32324351bd7405307873f7101f113a7e022ed9ec06ee1689b9 

# SHA256
40a340087cc07780bfd61eab92e40f1223a6de88ec191bdedea0b91b16eca2aa 

# SHA256
f329ea2c754ab196d15c20fbf9abd722fa63630631144c5a409bd2a20172196b 

# SHA256
afec2b2af3ace2c478382f9366f6cbc9b9579f2c9a4273150fc33a2ccd59284c 

# SHA256
3329641a171508fa6b1ad7674b31431093d46be190d1a51acd77e486f42d9c8e 

# SHA256
f2c9ae3735430b930a81148c0bb470fcb733e456a2a942f859a1b59c4a7b2150 

# SHA256
d1dcf4c2165f3cf5729ba76e1ee80f4709d8e7eca7a6c29ceffc5fc6b09660fe 

# SHA256
390ed1dde4ff03adfcf67c59ee02567ac5665bb5e029eaebf0332bc81e4d1891 

# SHA256
4bef307f6ffd4f7335adc9a72258c1c196ff2f55b5d422e12505ffcd916b993a 

# SHA256
91eb391fb81353b7bc4794d525997a5dfdbb1d5f1e7e3582e52f8c678adfb900 

# SHA256
cfaf5c17b24af5463975daa676da4291e58ea80e9497df62e2dca2abda0ed681 

# SHA256
a6b93a36b226140c0048811bc07bda4377484857c3207bc37d3b8880da5c6740 

# SHA256
0239a0ffbfd6198ec9fd73a9cac589942939328402884d6d7e03abb5f9e41850 

# MD5
f53f3926c9e319ebc4cffdf86bccb5a4 

# MD5
2ad5259b79936524afc5bd4b2b024da2 

# MD5
fb6ca1cd232151d667f6cd2484fee8c8 

# MD5
4cf4a9c9b246071ba09e68443361a9a8 

# MD5
e39a45a39945294c26bd7f80fc7dd966 

# MD5
b66eb4bcb2860ef48afbc1378e1ae545 

# MD5
c24a08bfeb09c9842b8e6578d7b0b721 

# MD5
f8dd9bb21344d1b810f334d483c07039 

# MD5
00201e5ad4e27ff63ea32fb9a9bb2c2e 

# MD5
0083da23232ec9e8040f46c0c2abc07f 

# MD5
7932ee5fa6f83b149569752c47e04b87 

# MD5
c209817538e86f5ea49fa6bd180dbf01 

# MD5
1720b1748ad7b8ac0bfc1c3636fead95 

# MD5
511aa2f2fe6196e032ec7fef83bb8d95 

# MD5
22943d9ceda4a9116856822a73c1bcc8 

# MD5
0d0823d9a5d000b80e27090754f59ee5 

# MD5
635e527b2f088abe94d546c6661cd22f 

# MD5
0ea968f98bd61d0646bf03e0907bf480 

# MD5
011ae2b76ac71ffcafd074210d8099ef 

# MD5
1238c7d4313505c7ecf60e6f2b6e9fc0 

# MD5
f53f3926c9e319ebc4cffdf86bccb5a4 

# MD5
2ad5259b79936524afc5bd4b2b024da2 

# MD5
fb6ca1cd232151d667f6cd2484fee8c8 

# MD5
4cf4a9c9b246071ba09e68443361a9a8 

# MD5
e39a45a39945294c26bd7f80fc7dd966 

# MD5
b66eb4bcb2860ef48afbc1378e1ae545 

# MD5
c24a08bfeb09c9842b8e6578d7b0b721 

# MD5
f8dd9bb21344d1b810f334d483c07039 

# MD5
00201e5ad4e27ff63ea32fb9a9bb2c2e 

# MD5
0083da23232ec9e8040f46c0c2abc07f 

# MD5
7932ee5fa6f83b149569752c47e04b87 

# MD5
c209817538e86f5ea49fa6bd180dbf01 

# MD5
1720b1748ad7b8ac0bfc1c3636fead95 

# MD5
511aa2f2fe6196e032ec7fef83bb8d95 

# MD5
22943d9ceda4a9116856822a73c1bcc8 

# MD5
0d0823d9a5d000b80e27090754f59ee5 

# MD5
635e527b2f088abe94d546c6661cd22f 

# MD5
0ea968f98bd61d0646bf03e0907bf480 

# MD5
011ae2b76ac71ffcafd074210d8099ef 

# MD5
1238c7d4313505c7ecf60e6f2b6e9fc0

Type	Value	Note
sha256	e1de0531f3954d365af908d2789d453fb12480199fd9bd06a58651f90d926afe	MB:Locky
sha256	17c3d74e3c0645edb4b5145335b342d2929c92dff856cca1a5e79fa5d935fec2	MB:Locky
sha256	dbb929b5989d63731106f2fc8239debdd23e888d3713ba836b1b357be48e0fb5	MB:Locky
sha256	0fe7d733494aeb44ed3dd48f78e3e48f9714fa807f9a09a92cfafa3dc9d6495f	MB:Locky
sha256	49a48d4ff1b7973e55d5838f20107620ed808851231256bb94c85f6c80b8ebfc	MB:Locky
sha256	df255af635a2dde04c031db95862f11e1bf44fe5cfc10d3b20bd4678ed818567	MB:Locky
sha256	36350904b065500f429e6b2af0c4a1ec835352fed15cad40f07760aede4fcd47	MB:Locky
sha256	ace15d620a4d8a32324351bd7405307873f7101f113a7e022ed9ec06ee1689b9	MB:Locky
sha256	40a340087cc07780bfd61eab92e40f1223a6de88ec191bdedea0b91b16eca2aa	MB:Locky
sha256	f329ea2c754ab196d15c20fbf9abd722fa63630631144c5a409bd2a20172196b	MB:Locky
sha256	afec2b2af3ace2c478382f9366f6cbc9b9579f2c9a4273150fc33a2ccd59284c	MB:Locky
sha256	3329641a171508fa6b1ad7674b31431093d46be190d1a51acd77e486f42d9c8e	MB:Locky
sha256	f2c9ae3735430b930a81148c0bb470fcb733e456a2a942f859a1b59c4a7b2150	MB:Locky
sha256	d1dcf4c2165f3cf5729ba76e1ee80f4709d8e7eca7a6c29ceffc5fc6b09660fe	MB:Locky
sha256	390ed1dde4ff03adfcf67c59ee02567ac5665bb5e029eaebf0332bc81e4d1891	MB:Locky
sha256	4bef307f6ffd4f7335adc9a72258c1c196ff2f55b5d422e12505ffcd916b993a	MB:Locky
sha256	91eb391fb81353b7bc4794d525997a5dfdbb1d5f1e7e3582e52f8c678adfb900	MB:Locky
sha256	cfaf5c17b24af5463975daa676da4291e58ea80e9497df62e2dca2abda0ed681	MB:Locky
sha256	a6b93a36b226140c0048811bc07bda4377484857c3207bc37d3b8880da5c6740	MB:Locky
sha256	0239a0ffbfd6198ec9fd73a9cac589942939328402884d6d7e03abb5f9e41850	MB:Locky
sha256	e1de0531f3954d365af908d2789d453fb12480199fd9bd06a58651f90d926afe	MB:Locky
sha256	17c3d74e3c0645edb4b5145335b342d2929c92dff856cca1a5e79fa5d935fec2	MB:Locky
sha256	dbb929b5989d63731106f2fc8239debdd23e888d3713ba836b1b357be48e0fb5	MB:Locky
sha256	0fe7d733494aeb44ed3dd48f78e3e48f9714fa807f9a09a92cfafa3dc9d6495f	MB:Locky
sha256	49a48d4ff1b7973e55d5838f20107620ed808851231256bb94c85f6c80b8ebfc	MB:Locky
sha256	df255af635a2dde04c031db95862f11e1bf44fe5cfc10d3b20bd4678ed818567	MB:Locky
sha256	36350904b065500f429e6b2af0c4a1ec835352fed15cad40f07760aede4fcd47	MB:Locky
sha256	ace15d620a4d8a32324351bd7405307873f7101f113a7e022ed9ec06ee1689b9	MB:Locky
sha256	40a340087cc07780bfd61eab92e40f1223a6de88ec191bdedea0b91b16eca2aa	MB:Locky
sha256	f329ea2c754ab196d15c20fbf9abd722fa63630631144c5a409bd2a20172196b	MB:Locky
sha256	afec2b2af3ace2c478382f9366f6cbc9b9579f2c9a4273150fc33a2ccd59284c	MB:Locky
sha256	3329641a171508fa6b1ad7674b31431093d46be190d1a51acd77e486f42d9c8e	MB:Locky
sha256	f2c9ae3735430b930a81148c0bb470fcb733e456a2a942f859a1b59c4a7b2150	MB:Locky
sha256	d1dcf4c2165f3cf5729ba76e1ee80f4709d8e7eca7a6c29ceffc5fc6b09660fe	MB:Locky
sha256	390ed1dde4ff03adfcf67c59ee02567ac5665bb5e029eaebf0332bc81e4d1891	MB:Locky
sha256	4bef307f6ffd4f7335adc9a72258c1c196ff2f55b5d422e12505ffcd916b993a	MB:Locky
sha256	91eb391fb81353b7bc4794d525997a5dfdbb1d5f1e7e3582e52f8c678adfb900	MB:Locky
sha256	cfaf5c17b24af5463975daa676da4291e58ea80e9497df62e2dca2abda0ed681	MB:Locky
sha256	a6b93a36b226140c0048811bc07bda4377484857c3207bc37d3b8880da5c6740	MB:Locky
sha256	0239a0ffbfd6198ec9fd73a9cac589942939328402884d6d7e03abb5f9e41850	MB:Locky
md5	f53f3926c9e319ebc4cffdf86bccb5a4	MB:Locky
md5	2ad5259b79936524afc5bd4b2b024da2	MB:Locky
md5	fb6ca1cd232151d667f6cd2484fee8c8	MB:Locky
md5	4cf4a9c9b246071ba09e68443361a9a8	MB:Locky
md5	e39a45a39945294c26bd7f80fc7dd966	MB:Locky
md5	b66eb4bcb2860ef48afbc1378e1ae545	MB:Locky
md5	c24a08bfeb09c9842b8e6578d7b0b721	MB:Locky
md5	f8dd9bb21344d1b810f334d483c07039	MB:Locky
md5	00201e5ad4e27ff63ea32fb9a9bb2c2e	MB:Locky
md5	0083da23232ec9e8040f46c0c2abc07f	MB:Locky
md5	7932ee5fa6f83b149569752c47e04b87	MB:Locky
md5	c209817538e86f5ea49fa6bd180dbf01	MB:Locky
md5	1720b1748ad7b8ac0bfc1c3636fead95	MB:Locky
md5	511aa2f2fe6196e032ec7fef83bb8d95	MB:Locky
md5	22943d9ceda4a9116856822a73c1bcc8	MB:Locky
md5	0d0823d9a5d000b80e27090754f59ee5	MB:Locky
md5	635e527b2f088abe94d546c6661cd22f	MB:Locky
md5	0ea968f98bd61d0646bf03e0907bf480	MB:Locky
md5	011ae2b76ac71ffcafd074210d8099ef	MB:Locky
md5	1238c7d4313505c7ecf60e6f2b6e9fc0	MB:Locky
md5	f53f3926c9e319ebc4cffdf86bccb5a4	MB:Locky
md5	2ad5259b79936524afc5bd4b2b024da2	MB:Locky
md5	fb6ca1cd232151d667f6cd2484fee8c8	MB:Locky
md5	4cf4a9c9b246071ba09e68443361a9a8	MB:Locky
md5	e39a45a39945294c26bd7f80fc7dd966	MB:Locky
md5	b66eb4bcb2860ef48afbc1378e1ae545	MB:Locky
md5	c24a08bfeb09c9842b8e6578d7b0b721	MB:Locky
md5	f8dd9bb21344d1b810f334d483c07039	MB:Locky
md5	00201e5ad4e27ff63ea32fb9a9bb2c2e	MB:Locky
md5	0083da23232ec9e8040f46c0c2abc07f	MB:Locky
md5	7932ee5fa6f83b149569752c47e04b87	MB:Locky
md5	c209817538e86f5ea49fa6bd180dbf01	MB:Locky
md5	1720b1748ad7b8ac0bfc1c3636fead95	MB:Locky
md5	511aa2f2fe6196e032ec7fef83bb8d95	MB:Locky
md5	22943d9ceda4a9116856822a73c1bcc8	MB:Locky
md5	0d0823d9a5d000b80e27090754f59ee5	MB:Locky
md5	635e527b2f088abe94d546c6661cd22f	MB:Locky
md5	0ea968f98bd61d0646bf03e0907bf480	MB:Locky
md5	011ae2b76ac71ffcafd074210d8099ef	MB:Locky
md5	1238c7d4313505c7ecf60e6f2b6e9fc0	MB:Locky

Locky — Go to Full Profile →