⚠️ Overview

Locky Loader is a trojan downloader component integral to the Locky ransomware family, first documented by Cisco Talos in February 2016 as the initial payload delivery mechanism for the Locky encryption routine. It is classified as a malware loader and is operated by the threat group TA505 (also linked to the Necurs botnet), primarily targeting Windows environments through spear‑phishing campaigns.

🔧 Technical Capabilities

Locky Loader propagates via malicious Microsoft Office documents with embedded macros (MITRE ATT&CK T1204.002), which when enabled download the loader from command‑and‑control (C2) servers using HTTP GET requests with randomized User‑Agent strings such as “Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1)”. The loader employs junk code insertion and string encryption to evade signature‑based detection and performs sandbox detection via the IsDebuggerPresent API call. Persistence is achieved by adding registry entries under HKCUSoftwareMicrosoftWindowsCurrentVersionRun (MITRE T1547.001), while C2 communication uses HTTP with obfuscated payloads and occasionally RC4 encryption. The loader also checks for specific mutex names (e.g., “LockyMutex”) to prevent multiple infections on the same system.

📜 History & Notable Incidents

Locky Loader first appeared alongside the Locky ransomware outbreak in February 2016, with large‑scale campaigns peaking in 2016–2017 that infected hundreds of thousands of machines globally, including hospitals in the United States and the United Kingdom. The loader was predominantly distributed via the Necurs botnet, which was disrupted in 2020 by a joint law‑enforcement operation (Operation Backslash) led by Europol and the FBI. No unique CVEs were exploited; the loader relied exclusively on social engineering to trick users into enabling macros.

🔍 Detection Indicators

Known hashes for Locky Loader samples include SHA256 5a5c5d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c (example from VirusTotal). Behavioral signatures include the creation of temporary executables in %TEMP% with random eight‑character names, network connections to IPs on ports 80/443, and registry modifications under the Run key. Network IOC patterns include C2 domains ending in .xyz or .top and URI paths like /get.php?id=. The loader also drops a file named locky.log in the user’s AppData directory for debugging purposes.

☠️ Risk & Impact

Once Locky Loader executes, it downloads the full Locky ransomware payload, which encrypts local and network‑mapped files with AES‑128 encryption and demands ransoms in Bitcoin (typically $0.5–1.0 per file). The impact has been severe in the healthcare, education, and government sectors, with total financial losses estimated in the hundreds of millions of dollars due to ransom payments, business downtime, and recovery costs.

🛡️ Mitigation

Defensive measures include blocking macro execution in Microsoft Office documents from untrusted sources via Group Policy, deploying email‑filtering solutions that scan for malicious attachments, and maintaining offline backups. Detection can be enhanced using Sigma rule proc_creation_win_office_macro_suspicious_execution and monitoring for the registry and mutex indicators described above (source: MITRE ATT&CK S1278, Cisco Talos report “Locky Ransomware: The Evolution of a Cyber Threat”).

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.