Home > Threat descriptions >



Category: Malware

Type: Trojan-Downloader

Aliases: Trojan-Downloader:JS/Locky.[variant], Locky.[variant]


Trojan-Downloader:JS/Locky is ransomware that encrypts files saved on the machine and demands payment of a ransom in order to obtain the decryption key needed to restore normal access to the affected files.


Automatic action

F-Secure detects ransomware using a variety of signature and generic detections. Once detected, the F-Secure security product will automatically disinfect the suspect file by either deleting or renaming it.

Further action

If the ransomware uses encryption to take files or an entire system hostage, the encryption may be sufficient to make it very difficult to decrypt the files without the necessary decryption key.

In such circumstances, the recommended course of action is to report the crime to the relevant authorities and restore the affected data from a recent clean backup.

Knowledge Base

Find the latest advice in our Community Knowledge Base.

About the product

See the manual for your F-Secure product on the Help Center.

Contact Support

Chat with or call an expert for help.

Submit a sample

Submit a file or URL for further analysis.

Technical Details

Users typically encounter Locky ransomware by either being exposed to an exploit kit or via a spam email message with a file attachment.

Delivery via email

The most common way Locky ransomware is distributed is as a file attached to a email message. The emails may appropriate the names and/or branding of various legitimate companies to appear authentic. They will typically appear to be related to invoices, court orders or logistic/baggage related topics.

The file attachment may be a zipped folder (.zip) that contains a JavaScript (.js) file. It may also be a file that uses a multiple extension - for example INVOICE#132435.PDF.js. Using multiple extensions this way is an established tactic by malware authors to trick users into believing that the file does not contain executable code (the JavaScript) and is instead a static viewable file.

If the user opens the attachment, the JavaScript code will run and try to download the component that performs the actual encryption from a remote server.

Delivery via exploit kit

Locky ransomware can also be delivered as the payload of an exploit kit. If the user is exposed to a exploit kit (usually by visiting a compromised website, or by being redirected to a malicious one) and it successfully exploits the user's machine, the kit will download the ransomware and it will immediately run.


Locky ransomware encrypt files stored on the machine. Depending on the specific variant, the encryption can be done using either the AES 128-bit or RSA 2048-bit encryption algorithms - which are extremely difficult to break.

Once the files are encrypted, a text file containing the ransom demand is saved on the system. In some variants, the desktop background is also changed to display the demand. The file will provide instructions on how to pay the ransom demanded.

Date Created: -

Date Last Modified: -