Loading malware…
CryptoLocker is an early and highly influential Windows ransomware family first observed in 2013 and widely regarded as one of the first modern large-scale file-encrypting ransomware operations. Unlike earlier locker-style threats that primarily blocked access to the desktop, CryptoLocker encrypted victim files and demanded payment for decryption, helping establish the modern ransomware model.
CryptoLocker was distributed initially through spam campaigns carrying malicious attachments and later at scale through the Upatre downloader, the Gameover Zeus ecosystem, and the Cutwail botnet. Additional delivery through exploit-kit activity, including Blackhole and Magnitude, has also been reported. After execution, the malware established persistence in the user profile and configured autorun behavior to survive reboots. It then contacted command-and-control infrastructure using both hard-coded destinations and a domain generation algorithm.
Once active, CryptoLocker enumerated local drives, network shares, and later removable media, and encrypted a broad range of business and personal file types using strong cryptography implemented through Microsoft CryptoAPI. Reported analyses describe per-file symmetric encryption protected by attacker-controlled asymmetric keys, which made recovery without the corresponding private key impractical. The malware typically remained silent until encryption had completed, then presented a ransom interface with a payment deadline. Operators later added a decryption service for victims who missed the initial deadline.
CryptoLocker is closely associated with the Gameover Zeus criminal operation and has been linked in public reporting to the broader Russian-speaking cybercrime ecosystem around that botnet. It caused substantial global impact, with hundreds of thousands of infections reported during its active period and especially heavy victimization in English-speaking countries, including the United States. Its combination of resilient distribution, effective monetization, and strong encryption made it a defining ransomware threat and a template for many later families.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Individual operators often dropped other malware • CryptoLocker – first in-house development, destructive
20 distinct techniques documented for this family, organized by ATT&CK tactic.
the samples were downloaded from a compromised website located in the United States... Gameover Zeus has also been distributed by the Blackhole and Magnitude exploit kits.
The malware begins the encryption process by using the GetLogicalDrives() API call to enumerate the disks on the system that have been assigned a drive letter.
Initially peer-to-peer + traditional comms via gameover2.php
CryptoLocker cycles indefinitely until it connects to a C2 server via HTTP.
This service is available by connecting directly to a Command & Control server's IP address or hostname or through Tor via the f2d2v7soksbskekh.onion/ address.
GOZ includes code that permits the defendants to install additional malicious software onto computers infected with GOZ. The defendants and their co-conspirators have used this capability to install Cryptolocker onto numerous computers within the GOZ botnet.
This decryption service can also be accessed via TOR at the address f2d2v7soksbskekh.onion/.
The malware's network communications use an internal domain generation algorithm (DGA) that produces 1,000 potential C2 domain addresses per day.
CryptoLocker changes this dynamic by aggressively encrypting files on the victim's system... Each file is encrypted with a unique AES key, which in turn is encrypted with the RSA public key received from the C2 server.
14 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Other indicator types observed in public reporting.
70 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as additional malware distributed by Gameover Zeus.
Referenced as a ransomware family that used TOR-based victim communication, contrasted with Petya and NotPetya's email-based approach.
Referenced as a previous ransomware example for comparison with WannaCry's TOR-based C2 design.
Ransomware that encrypts files on local and mounted network drives using a hybrid cryptosystem: AES for file encryption and RSA public-key cryptography for encrypting AES keys, with the private key stored on attackers’ control servers. It propagates via email attachments, uses a Domain Generation Algorithm (DGA) to reach C2 infrastructure, maintains persistence via parent/child processes, and replaces original files with encrypted temporary files.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.