Understanding Locky

This report analyzes the Locky ransomware campaign (Feb 2016), describing delivery through malicious Microsoft Word macros, execution/persistence (copying to Temp, Run key), anti-analysis measures (MMX/SSE checks, INT3 loops, TLS callbacks), C2 communications (HTTP POST to main.php, DGA/hardcoded IPs), encryption behavior (AES-based file encryption with RSA-protected keys, renaming files to a 32-hex identifier + .locky), deletion of Volume Shadow Copies, and deployment of ransom notes and Tor payment infrastructure; it also provides IOCs and mitigation recommendations (backups, user awareness).