From fa723b6e9057be889dfbec70c06af93d3a7fbc89 Mon Sep 17 00:00:00 2001
From: Deborah Servili <deborah.servili@gmail.com>
Date: Wed, 4 Oct 2017 09:32:55 +0200
Subject: [PATCH] add lukitus ransomnote to Locky

---
 clusters/ransomware.json | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/clusters/ransomware.json b/clusters/ransomware.json
index c0848c2..d9013c7 100644
--- a/clusters/ransomware.json
+++ b/clusters/ransomware.json
@@ -6495,7 +6495,9 @@
           "_WHAT_is.html",
           "_INSTRUCTION.html",
           "DesktopOSIRIS.(bmp|htm)",
-          "OSIRIS-[0-9]{4}.htm"
+          "OSIRIS-[0-9]{4}.htm",
+          "lukitus.htm",
+          "lukitus.bmp."
         ],
         "refs": [
           "http://www.bleepingcomputer.com/news/security/new-locky-version-adds-the-zepto-extension-to-encrypted-files/",