MalwareRansomware

Cryptolocker 2.0

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

9 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1091Replication Through Removable MediaEvidence1

Cryptolocker 2.0 is also capable of spreading via removable media by replacing the content of .exe files they contain with its own body.

Persistence

2 techniques

T1547.001Registry Run Keys / Startup FolderEvidence1

It will then create one of the following autostart entries in the registry to start CryptoLocker when you login: KEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "CryptoLocker" ... HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce "*CryptoLocker"

T1547.004Winlogon Helper DLLEvidence1

HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit C:\Windows\system32\userinit.exe,,%AppData%\Microsoft\msunet.exe

Privilege Escalation

2 techniques

T1547.001Registry Run Keys / Startup FolderEvidence1

T1547.004Winlogon Helper DLLEvidence1

HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit C:\Windows\system32\userinit.exe,,%AppData%\Microsoft\msunet.exe

Stealth

1 technique

T1036MasqueradingEvidence1

The application includes windows that mimic “activators” or cracks for proprietary software, including Microsoft Windows, Microsoft Office, Team Viewer, Adobe Photoshop or even ESET Smart Security. The application chooses which window to display depending on the binary’s file name.

Lateral Movement

1 technique

T1091Replication Through Removable MediaEvidence1

Cryptolocker 2.0 is also capable of spreading via removable media by replacing the content of .exe files they contain with its own body.

Command and Control

1 technique

T1071Application Layer ProtocolEvidence2

When the malware is run, it contacts the C&C server to request a unique RSA public key.

Impact

4 techniques

T1486Data Encrypted for ImpactEvidence1

After infection, they scan the victim’s folder structure for files matching a set of file extensions, encrypt them and display a message window that demands a ransom in order to decrypt the files.

T1496Resource HijackingEvidence1

This malware contains a cryptocoin miner called BFGMiner that could allow it to mine Bitcoins, and other crypto coins, using the CPU power or graphic card on your computer.

T1498Network Denial of ServiceEvidence1

Based on strings found in the executable, this malware appears to be able perform DDOS attacks.

T1499Endpoint Denial of ServiceEvidence1

The list of functionalities present in the trojan code is quite extensive and also includes ... running DDoS attacks against a specified server.

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

eset welivesecurity blogNews

Dec 19, 2013

Cryptolocker 2.0 - new version, or copycat?

A likely copycat of CryptoLocker rather than a true new version. It encrypts files and demands Bitcoin ransom, claims RSA-4096 but actually uses RSA-1024, requests an RSA public key from its C2, encrypts files with per-file random 3DES keys, and stores encrypted keys in separate .k files. It was written in C#, targets a broader set of file types including media files, masquerades as software cracks, can spread via removable media, and includes additional capabilities such as stealing Bitcoin wallet files, launching BFGMiner, and conducting DDoS attacks.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping9

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareRansomware

Cryptolocker 2.0

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

9 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1091Replication Through Removable MediaEvidence1

Cryptolocker 2.0 is also capable of spreading via removable media by replacing the content of .exe files they contain with its own body.

Persistence

2 techniques

T1547.001Registry Run Keys / Startup FolderEvidence1

T1547.004Winlogon Helper DLLEvidence1

HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit C:\Windows\system32\userinit.exe,,%AppData%\Microsoft\msunet.exe

Privilege Escalation

2 techniques

T1547.001Registry Run Keys / Startup FolderEvidence1

T1547.004Winlogon Helper DLLEvidence1

HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit C:\Windows\system32\userinit.exe,,%AppData%\Microsoft\msunet.exe

Stealth

1 technique

T1036MasqueradingEvidence1

Lateral Movement

1 technique

T1091Replication Through Removable MediaEvidence1

Cryptolocker 2.0 is also capable of spreading via removable media by replacing the content of .exe files they contain with its own body.

Command and Control

1 technique

T1071Application Layer ProtocolEvidence2

When the malware is run, it contacts the C&C server to request a unique RSA public key.

Impact

4 techniques

T1486Data Encrypted for ImpactEvidence1

After infection, they scan the victim’s folder structure for files matching a set of file extensions, encrypt them and display a message window that demands a ransom in order to decrypt the files.

T1496Resource HijackingEvidence1

This malware contains a cryptocoin miner called BFGMiner that could allow it to mine Bitcoins, and other crypto coins, using the CPU power or graphic card on your computer.

T1498Network Denial of ServiceEvidence1

Based on strings found in the executable, this malware appears to be able perform DDOS attacks.

T1499Endpoint Denial of ServiceEvidence1

The list of functionalities present in the trojan code is quite extensive and also includes ... running DDoS attacks against a specified server.

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

eset welivesecurity blogNews

Dec 19, 2013

Cryptolocker 2.0 - new version, or copycat?

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping9

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.