Loading malware…
RegretLocker is a Windows ransomware family identified in 2020 that is notable for encrypting the contents of mounted virtual hard disks rather than only encrypting ordinary files on accessible volumes. It specifically searches for virtual disk image formats used in Windows and Hyper-V environments, mounts those images through the Windows Virtual Storage API, and then encrypts the files inside them individually. This approach improves speed and effectiveness against large virtual disk containers and can significantly impact virtualized workloads and backup media.
RegretLocker encrypts victim data with AES and protects the symmetric key with RSA. It retrieves an RSA public key from attacker-controlled infrastructure over Tor, while some observed samples also contain a hard-coded fallback RSA key used when command-and-control is unreachable. The malware appends a distinct extension to encrypted files and drops ransom notes in affected locations.
The ransomware is designed to maximize file access and hinder recovery. It deletes shadow copies and backup-related data, disables recovery options, and attempts to terminate processes or services that keep files open. Observed samples use the Windows Restart Manager API and command-line process termination to close locking applications while excluding certain system-critical or operator-useful processes. RegretLocker also mounts fixed, removable, and remote volumes, encrypts USB-accessible data, and includes functionality to enumerate SMB-accessible systems and folders for encryption of reachable network shares.
Persistence has been observed through both autorun configuration and a scheduled task. RegretLocker also checks for an existing instance of itself before proceeding. Some samples extract an auxiliary Tor communication component and use it to send host information, obtain cryptographic material, and signal encryption status.
RegretLocker is associated with financially motivated extortion activity rather than espionage. Its tradecraft shows emphasis on operational efficiency, recovery inhibition, and impact against enterprise environments that rely on virtual disks, shared storage, and backups.
16 distinct techniques documented for this family, organized by ATT&CK tactic.
Next, it also schedules the malware as a task every minite using this Schtasks.exe command... schtasks /Create /SC MINUTE /TN "Mouse Application" /TR "RegretLocker_path" /f
The malware builds and executes this command from cmd.exe . cmd.exe /C wmic SHADOWCOPY DELETE & wbadmin DELETE SYSTEMSTATEBACKUP & bcdedit.exe / set{ default } bootstatuspolicy ignoreallfailures & bcdedit.exe / set{ default } recoveryenabled No
After extracting the dll, it calls LoadLibrary to get a handle to the dll. This handle will be used for the malware to contact C&C.
Next, it also schedules the malware as a task every minite using this Schtasks.exe command... schtasks /Create /SC MINUTE /TN "Mouse Application" /TR "RegretLocker_path" /f
For persistence, the malware set the registry SOFTWARE\Microsoft\Windows\CurrentVersion\Run to the path of the malware. This ensures that the malware is automatically run every time the user logs into the machine.
Next, it also schedules the malware as a task every minite using this Schtasks.exe command... schtasks /Create /SC MINUTE /TN "Mouse Application" /TR "RegretLocker_path" /f
For persistence, the malware set the registry SOFTWARE\Microsoft\Windows\CurrentVersion\Run to the path of the malware. This ensures that the malware is automatically run every time the user logs into the machine.
The malware writter has 2 weird checks to check for a particular user name and PC name( WIN-295748OMAKG ). If the user name or the PC name matches, the malware will exit immediately.
There is a class called smb_scanner . The SMB function tries SMB scanning to find Adapter names and address ranges on the adapter NetServers’s IP addresses and machine names on the server using NetServerEnum .
RegretLocker first check if there is only one version of itself running by looping through all of the running processes using CreateToolhelp32Snapshot, Process32First, and Process32Next.
RegretLocker contacts the C&C server... Sending information such as the computer's IP, name, volume of the disks,.. Before contacting C&C, it sends a GET request to http://api.ipify.org/ to retrieve the PC’s public IP address.
small_encrypt() calls a wrapper function to navigate around directories and files before encrypting them... If the file type is FILE_ATTRIBUTE_DIRECTORY, it will calls a recursive encrypting function to recursively go through every layer inside the folder.
RegretLocker uses an interesting technique of mounting a virtual disk file so each of its files can be encrypted individually.
The malware writter has 2 weird checks to check for a particular user name and PC name( WIN-295748OMAKG ). If the user name or the PC name matches, the malware will exit immediately.
The SMB function tries SMB scanning... using NetServerEnum . The result value is a buffer of all the SMB folders in string form. Then, it goes through a while loop calling a function to encrypt these SMB folders
RegretLocker contacts the C&C server at http://regretzjibibtcgb.onion/input through Tor 3 times: - Retrieve RSA key from server - Sending information such as the computer's IP, name, volume of the disks,.. - Signalling when it finishes encrypting
The malware extracts the path to the current directory... drops this dll in the same directory of the malware... After extracting the dll, it calls LoadLibrary to get a handle to the dll. This handle will be used for the malware to contact C&C.
RegretLocker is a new ransomware that has been found in the wild... it will particularly search for VHD files, mount them using Windows Virtual Storage API, and then encrypt all the files it finds inside of those VHD files.
Then it will attempt the encryption again... RegretLocker then builds the command string taskkill /F /IM \process_name and runs it with cmd.exe . This command basically just filters out the process with the given process name and terminates it.
wmic SHADOWCOPY DELETE : This will delete all of the shadow copies... wbadmin DELETE SYSTEMSTATEBACKUP : Delete system backup... bcdedit.exe ... recoveryenabled No : Make sure the system can’t be recovered.
4 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.