Loading malware…
CryptoLocker is an early and highly influential Windows ransomware family first observed in September 2013. It helped define the modern ransomware model by encrypting victim files rather than merely locking the screen, then demanding payment for decryption. The malware became widely known for using strong cryptography, combining per-file symmetric encryption with attacker-controlled asymmetric key protection, which made recovery without the operators’ private key impractical in most cases.
CryptoLocker was initially distributed through spam campaigns, often using malicious compressed attachments, and later at scale through the Gameover Zeus ecosystem. Delivery chains commonly involved the Upatre downloader and Gameover Zeus, with additional distribution linked to botnet and exploit-kit infrastructure. After execution, CryptoLocker established persistence on the infected host, contacted command-and-control infrastructure using both hard-coded destinations and a domain generation algorithm, received keying material, and then encrypted targeted data on local drives, network shares, and later removable media.
The malware targeted a broad range of user and business data, including office documents, databases, images, certificates, design files, and PDFs. It delayed overt ransom messaging until encryption had completed, then presented a payment interface with a countdown timer. Operators demanded relatively standardized ransom amounts and later introduced a decryption service for victims who missed the initial deadline. Contemporary reporting indicated that operators often provided decryption after payment, reinforcing the scheme’s criminal business model.
CryptoLocker is closely associated with the Gameover Zeus criminal operation and has been linked in public reporting to actors in Russia, including allegations involving Evgeniy Bogachev and the broader Business Club/Gameover Zeus ecosystem. It caused substantial global impact, with infections concentrated in English-speaking countries, especially the United States, and is widely regarded as one of the first major modern ransomware families to demonstrate the profitability and scalability of file-encryption extortion.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Individual operators often dropped other malware • CryptoLocker – first in-house development, destructive
20 distinct techniques documented for this family, organized by ATT&CK tactic.
the samples were downloaded from a compromised website located in the United States... Gameover Zeus has also been distributed by the Blackhole and Magnitude exploit kits.
The malware begins the encryption process by using the GetLogicalDrives() API call to enumerate the disks on the system that have been assigned a drive letter.
Initially peer-to-peer + traditional comms via gameover2.php
CryptoLocker cycles indefinitely until it connects to a C2 server via HTTP.
This service is available by connecting directly to a Command & Control server's IP address or hostname or through Tor via the f2d2v7soksbskekh.onion/ address.
GOZ includes code that permits the defendants to install additional malicious software onto computers infected with GOZ. The defendants and their co-conspirators have used this capability to install Cryptolocker onto numerous computers within the GOZ botnet.
This decryption service can also be accessed via TOR at the address f2d2v7soksbskekh.onion/.
The malware's network communications use an internal domain generation algorithm (DGA) that produces 1,000 potential C2 domain addresses per day.
CryptoLocker changes this dynamic by aggressively encrypting files on the victim's system... Each file is encrypted with a unique AES key, which in turn is encrypted with the RSA public key received from the C2 server.
14 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Other indicator types observed in public reporting.
69 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as additional malware distributed by Gameover Zeus.
Referenced as a ransomware family that used TOR-based victim communication, contrasted with Petya and NotPetya's email-based approach.
Referenced as a previous ransomware example for comparison with WannaCry's TOR-based C2 design.
Ransomware that encrypts files on local and mounted network drives using a hybrid cryptosystem: AES for file encryption and RSA public-key cryptography for encrypting AES keys, with the private key stored on attackers’ control servers. It propagates via email attachments, uses a Domain Generation Algorithm (DGA) to reach C2 infrastructure, maintains persistence via parent/child processes, and replaces original files with encrypted temporary files.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.