MBCProject-mbc-markdown/xample-malware/locky-bart.md

ID	X0011
Aliases	None
Platforms	Windows
Year	2017
Associated ATT&CK Software	None

Locky Bart

Locky Bart is ransomware. [1]

Behaviors

Name	Use
Process Discovery	Gathers information from the victim's machine to create an encryption key.
System Time Discovery	Gathers information from the victim's machine to create an encryption key.
Data Encrypted for Impact	Encrypts files for ransom without any connection to the Internet.
Executable Code Virtualization	Code virtualization is added to the Locky Bart binary using WPProtect. [1]

References

[1] https://blog.malwarebytes.com/threat-analysis/2017/01/locky-bart-ransomware-and-backend-server-analysis/