Skip to main content
Live Webinar with SANS (June 25)— Agentic CTI Automation for Fun & ProfitRegister Free
Mallory
Back to malware
MalwareRansomware

CryptoLocker

CryptoLocker is a Windows-based ransomware family first seen in September 2013 that encrypts victim files using strong public-key cryptography and demands payment for decryption, typically within a 72- to 96-hour deadline. The malware is described as using RSA-2048 together with AES, retrieving a public key from command-and-control infrastructure and keeping the private decryption key off the victim system. It targets valuable user and business data including Microsoft Office documents, photos, MP3 files, databases, certificates, archives, and other common file types on local drives and mapped network drives; some reporting also notes mounted backups can be encrypted. CryptoLocker commonly arrives via phishing and spam campaigns, including ZIP attachments containing executables disguised as PDF files, and was also distributed through watering-hole attacks and by the Gameover Zeus botnet/Zbot infections. It persists from randomly named executables in %AppData% or %LocalAppData% using Run/RunOnce registry entries, records encrypted files in the registry, and attempts to delete Shadow Volume Copies via vssadmin. Payment methods mentioned in the content include Bitcoin, MoneyPak, prepaid cards, Ukash, and cashU, with ransom amounts commonly cited around $100 to $300, though some victims reportedly paid more. The malware was heavily associated with Gameover Zeus and the criminal enterprise tied by U.S. authorities to Evgeniy Mikhailovich Bogachev; DOJ and related reporting state GOZ was a primary vehicle for seeding CryptoLocker infections. Reported impact figures in the content include more than 234,000 infected computers, including over 117,000 in the United States, and more than $27 million in ransom payments in its first two months online. Targeting was global, with the United States specifically noted as heavily affected and business users frequently impacted; examples include an insurance company in Pittsburgh and a Massachusetts police department. Law-enforcement and private-sector disruption during Operation Tovar/Gameover in June 2014 seized or neutralized infrastructure associated with CryptoLocker, after which the original CryptoLocker distribution network was disabled. Notable indicators and artifacts directly mentioned in the content include registry paths such as HKEY_CURRENT_USER\Software\CryptoLocker\Files and HKEY_CURRENT_USER\Software\CryptoLocker_0388\Files, autostart entries under HKCU\Software\Microsoft\Windows\CurrentVersion\Run or RunOnce, execution from %AppData% or %LocalAppData%, use of DGA-generated domains, and the command to delete shadow copies: vssadmin Delete Shadows /All /Quiet.

Share:
For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

MITRE ATT&CK

Techniques & procedures

19 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

3 techniques
T1189Drive-by CompromiseEvidence1

The malicious software... can sneak into your machine via an email attachment or a 'drive-by download', which you would not even be aware is taking place.

T1566PhishingEvidence2

Ransomware attacks are nothing new. Cybercriminals have been targeting people and businesses for years, often using emails as a way to carry out the attack.

T1566.001Spearphishing AttachmentEvidence4

CryptoLocker was both a locker and crypto variant. It used an advanced 2,048-bit RSA key and propagated as email attachments to seemingly innocuous messages.

Execution

2 techniques
T1059Command and Scripting InterpreterEvidence1

Some of the most commonly used commands used by attackers are: user_execute <url> ... The user_execute command was used specifically for CryptoLocker installations too

T1059.003Windows Command ShellEvidence1

The command that is run when you click on an executable is: "C:\Windows\SYsWOW64\cmd.exe" /C "C:\Windows\Sysnative\vssadmin.exe" Delete Shadows /All /Quiet

Persistence

2 techniques
T1112Modify RegistryEvidence1

The infection will also hijack your .EXE extensions... The .EXE hijack in the Registry will look similar to the following... [HKEY_CLASSES_ROOT\.exe] @="Myjiaabodehhltdr" ... [HKEY_CLASSES_ROOT\Myjiaabodehhltdr\shell\open\command] @="\"C:\\Users\\User\\AppData\\Local\\Rlatviomorjzlefba.exe\" - \"%1\" %*"

T1547.001Registry Run Keys / Startup FolderEvidence1

It will then create one of the following autostart entries in the registry to start CryptoLocker when you login: KEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "CryptoLocker" ... HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce "*CryptoLocker"

Privilege Escalation

1 technique
T1547.001Registry Run Keys / Startup FolderEvidence1

It will then create one of the following autostart entries in the registry to start CryptoLocker when you login: KEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "CryptoLocker" ... HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce "*CryptoLocker"

Stealth

3 techniques
T1036MasqueradingEvidence2

These zip files contain executables that are disguised as PDF files as they have a PDF icon and are typically named something like FORM_101513.exe or FORM_101513.pdf.exe. Since Microsoft does not show extensions by default, they look like normal PDF files and people open them.

T1070.004File DeletionEvidence1

It will attempt to delete the Shadow Volume Copies that are on the affected computer... The command that is run when you click on an executable is: "C:\Windows\SYsWOW64\cmd.exe" /C "C:\Windows\Sysnative\vssadmin.exe" Delete Shadows /All /Quiet

T1497.001System ChecksEvidence1

CryptoLocker only encrypts data stored on network shares if the shared folders are mapped as a drive letter on the infected computer. Despite what some articles state, CryptoLocker does not encrypt data on a network through UNC shares.

Defense Impairment

1 technique
T1112Modify RegistryEvidence1

The infection will also hijack your .EXE extensions... The .EXE hijack in the Registry will look similar to the following... [HKEY_CLASSES_ROOT\.exe] @="Myjiaabodehhltdr" ... [HKEY_CLASSES_ROOT\Myjiaabodehhltdr\shell\open\command] @="\"C:\\Users\\User\\AppData\\Local\\Rlatviomorjzlefba.exe\" - \"%1\" %*"

Discovery

2 techniques
T1135Network Share DiscoveryEvidence1

CryptoLocker will then begin to scan all physical or mapped network drives on your computer for files with the following extensions...

T1497.001System ChecksEvidence1

CryptoLocker only encrypts data stored on network shares if the shared folders are mapped as a drive letter on the infected computer. Despite what some articles state, CryptoLocker does not encrypt data on a network through UNC shares.

Command and Control

6 techniques
T1071Application Layer ProtocolEvidence6

This service is available by connecting directly to a Command & Control server's IP address or hostname or through Tor via the f2d2v7soksbskekh.onion/ address.

T1090.003Multi-hop ProxyEvidence1

This service is available by connecting directly to a Command & Control server's IP address or hostname or through Tor via the f2d2v7soksbskekh.onion/ address.

T1105Ingress Tool TransferEvidence4

GOZ includes code that permits the defendants to install additional malicious software onto computers infected with GOZ. The defendants and their co-conspirators have used this capability to install Cryptolocker onto numerous computers within the GOZ botnet.

T1219Remote Access ToolsEvidence1

This decryption service can also be accessed via TOR at the address f2d2v7soksbskekh.onion/.

T1568Dynamic ResolutionEvidence2

Cryptolocker (Win32/Filecoder.BQ) also contains a domain-generation-algorithm for C&C addresses, whereas the new Cryptolocker 2.0 doesn’t contain such a feature.

T1568.002Domain Generation AlgorithmsEvidence3

End of May 2014 was D-Day for GameOver ZeuS, with both a technical takedown of infrastructure of both GOZ and Cryptolocker, takeover of the Cryptolocker DGA domains

Impact

2 techniques
T1486Data Encrypted for ImpactEvidence16

Infected machines typically display a warning that the victim’s files have been locked and can only be decrypted by sending a certain fraction or number of Bitcoins to a decryption service run by the perpetrators. Victims are given 72 hours to pay the ransom. | CryptoLocker is a prolific and very damaging strain of malware that uses strong encryption to lock files that are likely to be the most valued by victim users, including Microsoft Office documents, photos, and MP3 files.

T1490Inhibit System RecoveryEvidence1

WinLock was the first locker ransomware, a variant that completely locks victims out of their devices.

INDICATORS OF COMPROMISE

IOCs tracked for this family

10 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app
Network
7 tracked

IPs, domains, and DNS infrastructure linked to this family.

Other
3 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting
email●●●●●●●●●●●●View more in app9 years ago
domain●●●●●●●●●●●●View more in app9 years ago
domain●●●●●●●●●●●●View more in app13 years ago
domain●●●●●●●●●●●●View more in app13 years ago
domain●●●●●●●●●●●●View more in app13 years ago
domain●●●●●●●●●●●●View more in app13 years ago
ACTIVITY FEED

Recent activity

48 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.
IOC matching10

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping19

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.