malware family

Locky

unknownentity:malware_familyransomware · 1 source

Ransomware Affiliations with Dridex and Necurs botnets

Curated · btcintel

claims we make, each with its source and citation · sources may contradict; we show the set, never a score

Facts

id: locky
kind: malware family
status: unknown
aliases: Locky-Odin · Locky-Osiris · Locky-Osiris 2016 · Locky-Osiris 2017
jurisdictions: —
claims naming it: 14,911 · 0 attributions · 0 relations · 0 events

Identifiers

misp-galaxy 8d51a22e-3485-4480-af96-8ed0305a7aa6via misp-galaxy-ransomware

Relations

computedno relations recorded for this entity

Events

computedno dated events recorded for this entity

Claims naming this entitynewest first · 20 of 14,911

Lockyransomwarepayment
subjecttransactionce5095adad…e2a00373e9
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1ZceALc8ZyZJXajbhPf8MG5arkzj75jyw · 149,992,387 sat · time 2016-04-03 16:10 UTC · url https://ransomwhe.re/#address/1ZceALc8ZyZJXajbhPf8MG5arkzj75jyw
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_21492btcintel:annotations:21492@v3 sha256:aa54ab0e8e737c37
confidencetrusted provider · 50
Lockyransomwarepayment
subjecttransaction0bbfd46854…49fc2823fc
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1ZceALc8ZyZJXajbhPf8MG5arkzj75jyw · 7,613 sat · time 2016-04-03 17:09 UTC · url https://ransomwhe.re/#address/1ZceALc8ZyZJXajbhPf8MG5arkzj75jyw
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_21491btcintel:annotations:21491@v3 sha256:323447b2806544c9
confidencetrusted provider · 50
Lockyransomwarepayment address
subjectaddress1ZceALc8ZyZJXajbhPf8MG5arkzj75jyw
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencefamily raw Locky · url https://ransomwhe.re/#address/1ZceALc8ZyZJXajbhPf8MG5arkzj75jyw
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2
ann_21490btcintel:annotations:21490@v2 sha256:b8280b1ca9d38c0f
confidencetrusted provider · 50
Lockyransomwarepayment
subjecttransaction2c7c42e142…da5018bd6f
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1XNuRTtubPkF2AhuvYC9sV1dW5jkGbicV · 150,000,000 sat · time 2016-05-19 08:02 UTC · url https://ransomwhe.re/#address/1XNuRTtubPkF2AhuvYC9sV1dW5jkGbicV
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_21489btcintel:annotations:21489@v3 sha256:f2a8737bb76fcadf
confidencetrusted provider · 50
Lockyransomwarepayment address
subjectaddress1XNuRTtubPkF2AhuvYC9sV1dW5jkGbicV
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencefamily raw Locky · url https://ransomwhe.re/#address/1XNuRTtubPkF2AhuvYC9sV1dW5jkGbicV
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2
ann_21488btcintel:annotations:21488@v2 sha256:b76e7d25806ad8fe
confidencetrusted provider · 50
Lockyransomwarepayment
subjecttransaction04fc7f441f…7260a9565f
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1ULyABgVwuzVAh2ZjcTpZZxBL1HQ8Uxt2 · 500,000,000 sat · time 2016-06-10 20:55 UTC · url https://ransomwhe.re/#address/1ULyABgVwuzVAh2ZjcTpZZxBL1HQ8Uxt2
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_21487btcintel:annotations:21487@v3 sha256:66adda5035c1cfb1
confidencetrusted provider · 50
Lockyransomwarepayment address
subjectaddress1ULyABgVwuzVAh2ZjcTpZZxBL1HQ8Uxt2
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencefamily raw Locky · url https://ransomwhe.re/#address/1ULyABgVwuzVAh2ZjcTpZZxBL1HQ8Uxt2
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2
ann_21486btcintel:annotations:21486@v2 sha256:1160f6c10d4f04eb
confidencetrusted provider · 50
Lockyransomwarepayment
subjecttransactionebea716bcd…c02f0eed1e
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1W7VETgeGkNobCygqUaqm2uPLjjn6Z4gN · 50,000,000 sat · time 2016-03-20 23:11 UTC · url https://ransomwhe.re/#address/1W7VETgeGkNobCygqUaqm2uPLjjn6Z4gN
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_21471btcintel:annotations:21471@v3 sha256:23a5c6deccab8ae4
confidencetrusted provider · 50
Lockyransomwarepayment address
subjectaddress1W7VETgeGkNobCygqUaqm2uPLjjn6Z4gN
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencefamily raw Locky · url https://ransomwhe.re/#address/1W7VETgeGkNobCygqUaqm2uPLjjn6Z4gN
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2
ann_21470btcintel:annotations:21470@v2 sha256:b8864e55435687f0
confidencetrusted provider · 50
Lockyransomwarepayment
subjecttransactionf576303846…cfbd9d8ab0
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1xHu9ab3CREh9cLvm4LkQDh669ySTjkAu · 100,000,000 sat · time 2016-03-23 06:39 UTC · url https://ransomwhe.re/#address/1xHu9ab3CREh9cLvm4LkQDh669ySTjkAu
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_21453btcintel:annotations:21453@v3 sha256:d6f20265f64b7b71
confidencetrusted provider · 50
Lockyransomwarepayment address
subjectaddress1xHu9ab3CREh9cLvm4LkQDh669ySTjkAu
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencefamily raw Locky · url https://ransomwhe.re/#address/1xHu9ab3CREh9cLvm4LkQDh669ySTjkAu
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2
ann_21452btcintel:annotations:21452@v2 sha256:2ac0c6b670ba9c5a
confidencetrusted provider · 50
Lockyransomwarepayment
subjecttransaction6622ed1b18…1708a5b5e7
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1vFidoWeLZ2AGFmNKkFkHvaYjpYu17m2g · 50,000,000 sat · time 2016-03-23 06:39 UTC · url https://ransomwhe.re/#address/1vFidoWeLZ2AGFmNKkFkHvaYjpYu17m2g
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_21451btcintel:annotations:21451@v3 sha256:b94f181499982134
confidencetrusted provider · 50
Lockyransomwarepayment address
subjectaddress1vFidoWeLZ2AGFmNKkFkHvaYjpYu17m2g
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencefamily raw Locky · url https://ransomwhe.re/#address/1vFidoWeLZ2AGFmNKkFkHvaYjpYu17m2g
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2
ann_21450btcintel:annotations:21450@v2 sha256:f0d4e16fa5e187a5
confidencetrusted provider · 50
Lockyransomwarepayment
subjecttransaction9c3ec8ae60…3fc090e027
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1Y7XLJvS8XFiZPrQLH8f5D9Nb3tdenEgj · 50,000,000 sat · time 2016-02-16 16:49 UTC · url https://ransomwhe.re/#address/1Y7XLJvS8XFiZPrQLH8f5D9Nb3tdenEgj
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_21419btcintel:annotations:21419@v3 sha256:e1cab59dd3ff309f
confidencetrusted provider · 50
Lockyransomwarepayment address
subjectaddress1Y7XLJvS8XFiZPrQLH8f5D9Nb3tdenEgj
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencefamily raw Locky · url https://ransomwhe.re/#address/1Y7XLJvS8XFiZPrQLH8f5D9Nb3tdenEgj
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2
ann_21418btcintel:annotations:21418@v2 sha256:5ecff7559f7fb6a4
confidencetrusted provider · 50
Lockyransomwarepayment
subjecttransactionb908b647cb…e46021e726
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1uBSS8ExymQRahfyUqAVuxF7b43Xqd1B4 · 510,000,000 sat · time 2016-05-03 16:30 UTC · url https://ransomwhe.re/#address/1uBSS8ExymQRahfyUqAVuxF7b43Xqd1B4
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_21417btcintel:annotations:21417@v3 sha256:3ef5185360f593f8
confidencetrusted provider · 50
Lockyransomwarepayment address
subjectaddress1uBSS8ExymQRahfyUqAVuxF7b43Xqd1B4
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencefamily raw Locky · url https://ransomwhe.re/#address/1uBSS8ExymQRahfyUqAVuxF7b43Xqd1B4
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2
ann_21416btcintel:annotations:21416@v2 sha256:c7903004c6bb59e3
confidencetrusted provider · 50
Lockyransomwarepayment
subjecttransaction591446f291…1ff96dd7d1
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1xFvZ3jzWeJCwm4CTz524rLHD5BAM9bSS · 300,000,000 sat · time 2016-09-21 07:07 UTC · url https://ransomwhe.re/#address/1xFvZ3jzWeJCwm4CTz524rLHD5BAM9bSS
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_21415btcintel:annotations:21415@v3 sha256:8f84802d5d466fe5
confidencetrusted provider · 50
Lockyransomwarepayment address
subjectaddress1xFvZ3jzWeJCwm4CTz524rLHD5BAM9bSS
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencefamily raw Locky · url https://ransomwhe.re/#address/1xFvZ3jzWeJCwm4CTz524rLHD5BAM9bSS
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2
ann_21414btcintel:annotations:21414@v2 sha256:8c7f64bb2160e517
confidencetrusted provider · 50
Lockyransomwarepayment
subjecttransaction877aaf83ee…f89ef08bfa
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1xtCSx53VP69VuAUXMfFhY63GFbZ9JSkj · 100,000,000 sat · time 2016-03-28 07:15 UTC · url https://ransomwhe.re/#address/1xtCSx53VP69VuAUXMfFhY63GFbZ9JSkj
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_21413btcintel:annotations:21413@v3 sha256:fae5933b89ccc88f
confidencetrusted provider · 50

Subjects14,911 subjects carry a claim naming this entity · a sample

1123pJv8jzeFQaCV4w644pzQJzVWay2zcAaddress
1129TSjKtx65E35GiUo4AYVeyo48twbrGXaddress
112AmFATxzhuSpvtz1hfpa3Zrw3BG276pcaddress
112bgquxJZDPuQiXG8tsS7B8ER6rEetrAwaddress
112GocBgFSnaote6krx828qaockFraD8mpaddress
112igisnkkrR2rPgujxhBkTELajuNYxq8Zaddress
112wjYgWapZU8gTPR7hLoKq8iEh496vKxPaddress
1131P1hjj7h9NinHRCkNwGFifK4gGoe5EFaddress
1136MFiqBmoVWpqWr1okF3D5XMabwVLB5zaddress
11382a48qWatCiSqVNBFzuKN91M7Dcdevaddress

Community

notes from Nostr labelers · never merged with the bands above · not endorsed

Community content is indexed from Nostr and not endorsed by btcintel.

not computed yetNot indexed yet: the community index has not looked at this subject.