A new version of the Locky Ransomware was released yesterday that uses a new naming scheme for encrypted files. Previously Locky had renamed files and then appended a Locky extension so that filename was similar to A65091F1B14A911F0DD0E81ED3029F08.locky.

With this new version, Locky uses the .zepto extension and files are renamed to a name like 024BCD33-41D1-ACD3-3EEA-84083E322DFA.zepto. 

Files with the Zepto Extension
Files with the Zepto Extension

This new naming format is in the form of [first_8_hexadecimal_chars_of_id]-[next_4_hexadecimal_chars_of_id]-[next_4_hexadecimal_chars_of_id]-[4_hexadecimal_chars]-[12_hexadecimal_chars].zepto. For example, for a file called 024BCD33-41D1-ACD3-3EEA-84083E322DFA.zepto, the extracted victim ID would be 024BCD3341D1ACD3.

If there are any other modifications to this version we will update this article.

 

Related Articles:

BORN Ontario child registry data breach affects 3.4 million people

Dallas says Royal ransomware breached its network using stolen account

Bumblebee malware returns in new attacks abusing WebDAV folders

BlackCat ransomware hits Azure Storage with Sphynx encryptor

The Week in Ransomware - September 15th 2023 - Russian Roulette