Loading malware…
CTB-Locker, also known as Critroni, is a ransomware family whose name reflects its use of elliptic-curve cryptography, Tor-based infrastructure, and Bitcoin payments. It became known as a comparatively sophisticated crypto-ransomware strain because it combined strong public-key cryptography with anonymized payment and command infrastructure, making victim recovery without attacker-controlled key material generally impractical.
CTB-Locker has been distributed through spam campaigns using social-engineering lures and malicious attachments, including invoice-themed emails impersonating legitimate organizations. Infection chains documented for CTB-Locker include multi-stage droppers and crypters that unpack the ransomware in memory, establish persistence, and use anti-analysis checks before launching the final payload. Observed loader behavior includes sandbox and virtualization checks, mutex creation, in-memory execution via RunPE-style techniques, and loading into trusted Windows processes with elevated privileges.
Once active, CTB-Locker prepares host-specific victim metadata, establishes local state, and encrypts files across fixed, removable, and mapped network drives. It has been observed deleting shadow copies to hinder recovery and storing encrypted victim information locally for later use in the ransom workflow. Its cryptographic design uses Curve25519-based ECDH to derive shared secrets and AES-256 for file encryption, with per-file key material generated during encryption. This design has been assessed as robust enough that decryption without the attackers’ private key is typically infeasible except in limited edge cases such as intact backups, surviving shadow copies, rare memory-recovery opportunities, or law-enforcement seizure of backend infrastructure.
CTB-Locker communicates through Tor hidden services for payment and operational support, with fallback access methods observed in some campaigns when direct Tor connectivity is unavailable. The malware is associated with financially motivated ransomware activity and has been referenced alongside other major ransomware families in both incident-response and law-enforcement contexts. It primarily targets Windows environments and is notable for combining mature cryptographic implementation, defense evasion, persistence, and extortion-oriented file encryption.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
18 distinct techniques documented for this family, organized by ATT&CK tactic.
Ensure startup persistence (copy to startup folder, create registry entries, schedule task for startup, etc.)
What happens here is a bunch of CString objects get allocated and decoded into a piece of shellcode... The third and final layer of the crypter...
The second layer of the crypter... dynamically imports the API functions it needs from various DLLs.
The archive contains a single file named ‘Factuur 11100641293.pdf.exe’ with a PDF file icon hoping to trick unsuspecting users.
The final payload is executed (in-memory) using the RunPE technique... The executable is loaded into svchost.exe with elevated privileges
The executable is loaded into svchost.exe with elevated privileges
Check whether we are run in Sandboxie (check if sbiedll.dll is loaded in running process) Check whether we are run in virtualbox (check if VBoxService.exe or vmtoolsd.exe are running)
Check if an app named ‘myapp.exe’ is present in the system root directory. If it is, the process terminates... Check whether we are run in Sandboxie... Check whether we are run in virtualbox
Check whether we are run in Sandboxie (check if sbiedll.dll is loaded in running process) Check whether we are run in virtualbox (check if VBoxService.exe or vmtoolsd.exe are running)
24 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ransomware family referenced as an example of recognized ransomware strains.
Named in passing as an example of ransomware tied to prior arrests.
A widespread ransomware family whose interface, payment flow, wallpaper, and cryptographic design were closely imitated by Polyglot, though the analysis states there was no shared code beyond publicly available DLL code.
Mentioned as an example of other ransomware families for comparison/background only.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.