Ransom.LockerGoga

Short bio

Ransom.LockerGoga is Malwarebytes’ detection name for a ransomware that is primarily used in targeted, and very disruptive attacks.

Symptoms

Ransom.LockerGoga encrypts files on the affected system and adds the .locked extension to the encrypted files.
Ransom.LockerGoga shows a ransom note called README_LOCKED.txt

Ransom.LockerGoga ransom note

Users of affected systems may also find themselves locked out because their login credentials were changed.

Type and source of infection

Ransomware is a form of malware that locks you out of your device and/or encrypts your files, then forces you to pay a ransom to get them back.
Ransom.LockerGoga is typically delivered by a targeted attack using login credentials that the threat actor somehow got hold of.

Aftermath

Besides the encrypted files of the filetypes:

.doc, .dot, .docx, .docb, .dotx, .wkb, .xlm, .xml, .xls, .xlsx, .xlt, .xltx, .xlsb, .xlw, .ppt, .pps, .pot, .ppsx, .pptx, .posx, .potx, .sldx, .pdf, .db, .sql, .cs, .ts, .js, and .py

users my find that they have been locked out of their systems because their credentials were changed by the threat actor.

Protection

Malwarebytes protects users from Ransom.LockerGoga by using real-time protection.

Malwarebytes blocks Ransom.LockerGoga

Malwarebytes blocks Ransom.LockerGoga

Business remediation

Malwarebytes can detect and remove Ransom.LockerGoga on business machines without further user interaction.
To remove Ransom.LockerGoga using Malwarebytes business products, follow the instructions below.

How to remove Ransom.LockerGoga with Malwarebytes Endpoint Protection

  1. Go to the Malwarebytes Cloud console.
  2. To allow you to invoke a scan while the machine is off the network, go to Settings > Policies > your policy > General.
  3. Under Endpoint Interface Options, turn ON:
    1. Show Malwarebytes icon in notification area
    2. Allow users to run a Threat Scan (all threats will be quarantined automatically)

If you have infected machines that are not registered endpoints in Malwarebytes Endpoint Protection, you can remove {detection name} with our Breach Remediation tool (MBBR).

  1. Log into your My Account page and copy your license key. The key is needed to activate MBBR tool.
  2. Open your Cloud console.
  3. From a clean and safe machine, go to Endpoints > Add > Malwarebytes Breach Remediation. This will download the MBBR zip package.
  4. Unzip the package.
  5. Access a Windows command line prompt and issue the following commands:
    mbbr register –key:<prodkey>
    mbbr update
    Note: You must substitute your license key for <prodkey>.
  6. Copy the MBBR folder to a flash drive.
  7. From an infected, offline machine, copy the MBBR folder from the flash drive.
  8. Start a scan using the following command:
    mbbr scan –full –ark –remove –noreboot
  9. Refer to the Malwarebytes Breach Remediation Windows Administrator Guide for all supported scanning commands.

How to remove {detection name} with Malwarebytes Endpoint Security

You can use Malwarebytes Anti-Malware v1.80, which is included in your Malwarebytes Endpoint Security deployment to scan and remove {detection name}.

Option 1
  1. Remove the infected endpoint from the network.
  2. On the infected machine, right click the system tray icon and click on Start Scanner.
    MBES start scanner
  3. Select Perform full scan.
    MBES scan options
  4. Click on Scan button.
Option 2
  1. Open CMD
  2. CD to C:\Program Files (x86)\Malwarebytes’ Anti-Malware
  3. Run mbamapi /scan –full –remove -reboot

If the ransomware has encrypted some files before the behavioral detection kicked in, you can use the rollback feature (if available) to retrieve the files.

Consumer remediation

Malwarebytes can detect and remove Ransom.LockerGoga without further user interaction.

  1. Please download Malwarebytes to your desktop.
  2. Double-click mb3-setup-consumer-{version}.exe and follow the prompts to install the program.
  3. Then click Finish.
  4. Once the program has fully updated, select Scan Now on the Dashboard. Or select the Threat Scan from the Scan menu.
  5. If another update of the definitions is available, it will be implemented before the rest of the scanning procedure.
  6. When the scan is complete, make sure that all Threats are selected, and click Remove Selected.
  7. Restart your computer when prompted to do so.

Take note, however, that removing this ransomware does not decrypt your files. You can only get your files back from backups you made before the infection happened.

Traces/IOCs

Mutex:
MX-tgytutrc

Files:
%APPDATA%\Local\Temp\tgytutrc8.exe
%APPDATA%\Local\Temp\tgytutrc{4 Random Numbers}.exe

E-mail addresses used:
AbbsChevis@protonmail.com
AperywsQaroci@o2.pl
AsuxidOruraep1999@o2.pl
CottleAkela@protonmail.com
CouwetIzotofo@o2.pl
DharmaParrack@protonmail.com
DutyuEnugev89@o2.pl
IjuqodiSunovib98@o2.pl
MayarChenot@protonmail.com
PhanthavongsaNeveyah@protonmail.com
QicifomuEjijika@o2.pl
QyavauZehyco1994@o2.pl
RezawyreEdipi1998@o2.pl
RomanchukEyla@protonmail.com
SayanWalsworth96@protonmail.com
SchreiberEleonora@protonmail.com
SuzuMcpherson@protonmail.com
wyattpettigrew8922555@mail.com

Select your language