LockerGoga is ransomware that has been tied to various attacks on European companies. It was first reported upon in January 2019.[1][2]

ID: S0372
Platforms: Windows
Version: 1.3
Created: 16 April 2019
Last Modified: 20 March 2020

Techniques Used

Domain ID Name Use
Enterprise T1531 Account Access Removal

LockerGoga has been observed changing account passwords and logging off current users.[2][1]

Enterprise T1486 Data Encrypted for Impact

LockerGoga has encrypted files, including core Windows OS files, using RSA-OAEP MGF1 and then demanded Bitcoin be paid for the decryption key.[2][1][3]

Enterprise T1562 .001 Impair Defenses: Disable or Modify Tools

LockerGoga installation has been immediately preceded by a "task kill" command in order to disable anti-virus.[3]

Enterprise T1070 .004 Indicator Removal on Host: File Deletion

LockerGoga has been observed deleting its original launcher after execution.[2]

Enterprise T1570 Lateral Tool Transfer

LockerGoga has been observed moving around the victim network via SMB, indicating the actors behind this ransomware are manually copying files form computer to computer instead of self-propagating.[1]

Enterprise T1553 .002 Subvert Trust Controls: Code Signing

LockerGoga has been signed with stolen certificates in order to make it look more legitimate.[3]

Enterprise T1529 System Shutdown/Reboot

LockerGoga has been observed shutting down infected systems.[3]

Groups That Use This Software

ID Name References
G0037 FIN6