Ranstop stops LockyLocker ransomware

Test subject – LockyLocker ransomware

LockyLocker (also known as PyLocker) is a new ransomware which made its way to the digital world at the end of July, mostly via email campaigns. It was also discovered bundled alongside legitimate software, made with InnoSetup, so this should serve as a heads-up. It’s worth mentioning that this particular malware has nothing to do with the infamous Locky, which was among the first waves of global ransomware attacks a few years back, having a lot of other variants since then.

LockyLocker ransomware test facts

Once the initial downloader executes on the target machine, it will download a few files and then executes them. Among its initial actions, LockyLocker will also delete Shadow Volume Snapshots, to make sure any usual recovery attempts end in failure. It’s not among the fastest encrypting ransomware out there, as the entire process takes some time. It is also unusual, as for each original file, two new files are created. One, which will have the locky extension and probably contains the encrypted data, and another, having the original name and extension. The latter is always 6kb, and despite its original extension, it’s a text file, containing the ransom note. The note is translated into a few languages and it’s also dropped as a separate text file in each attacked folders. Reports say that the ransom is usually around $1300 in Bitcoins, but it may be negotiated. We do not encourage anybody to contact the cybercriminals, and as a basic rule, never pay any ransom, as there are no guarantees you will ever recover your files.

LockyLocker ransomware test results

TEMASOFT Ranstop detects LockyLocker ransomware easily once it starts encrypting files. Upon detection, the user is alerted, and the ransomware process is killed and quarantined. The affected files are automatically restored so that the user doesn’t lose her essential documents.

Click here to watch TEMASOFT Ranstop blocking LockyLocker ransomware (video)!

Learn how to protect against ransomware!

About TEMASOFT Ranstop

TEMASOFT Ranstop is an anti-ransomware software that detects present and future ransomware, based on file access pattern analysis with a high degree of accuracy. At the same time, it protects user files so that they can be restored in case of malware attacks or accidental loss.

For more information, follow us on social media and subscribe to our newsletter.

Follow @TemasoftSRL