From 671d7ea4561336dbd16a8977f52b521edddf98ab Mon Sep 17 00:00:00 2001
From: Deborah Servili <deborah.servili@gmail.com>
Date: Wed, 4 Oct 2017 09:22:53 +0200
Subject: [PATCH] add lukitus extension to Locky

---
 clusters/ransomware.json | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/clusters/ransomware.json b/clusters/ransomware.json
index 71dd290b..c0848c22 100644
--- a/clusters/ransomware.json
+++ b/clusters/ransomware.json
@@ -6482,7 +6482,8 @@
           "([A-F0-9]{32}).thor",
           "([A-F0-9]{32}).aesir",
           "([A-F0-9]{32}).zzzzz",
-          "([A-F0-9]{32}).osiris"
+          "([A-F0-9]{32}).osiris",
+          ".lukitus"
         ],
         "encryption": "AES-128",
         "ransomnotes": [