MALWARE FAMILY

CryptoLocker

Internal ID: win.cryptolocker

aliases

Last seen:Mar 17, 2026

Intelligence Profile

CryptoLocker is a new sophisticated malware that was launched in the late 2013. It is designed to attack Windows operating system by encrypting all the files from the system using a RSA-2048 public key. To decrypt the mentioned files, the user has to pay a ransom (usually 300 USD/EUR) or 2 BitCoins.

Threat Analysis

CryptoLocker is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→http://www.secureworks.com/research/threat-profiles/gold-evergreen

→https://docs.microsoft.com/en-us/security/compass/human-operated-ransomware

→https://sites.temple.edu/care/ci-rw-attacks/

→https://web.archive.org/web/20200509171721/https://raw.githubusercontent.com/fdiskyou/threat-INTel/master/2015/GlobalThreatIntelReport.pdf

→https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-008.pdf

→https://www.crowdstrike.com/blog/how-big-game-hunting-ttps-shifted-after-darkside-pipeline-attack/

→https://www.justice.gov/opa/pr/us-leads-multi-national-action-against-gameover-zeus-botnet-and-cryptolocker-ransomware

→https://www.secureworks.com/research/cryptolocker-ransomware

→https://www.secureworks.com/research/evolution-of-the-gold-evergreen-threat-group

→https://www.secureworks.com/research/threat-profiles/gold-evergreen

Quick Facts

TypeMalware Family

Aliases1

Also Known As

win.cryptolocker

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search CryptoLocker