CryptoLocker

CryptoLocker is a Windows-based ransomware family first seen in September 2013 that encrypts victim files using strong public-key cryptography and demands payment for decryption, typically within a 72- to 96-hour deadline. The malware is described as using RSA-2048 together with AES, retrieving a public key from command-and-control infrastructure and keeping the private decryption key off the victim system. It targets valuable user and business data including Microsoft Office documents, photos, MP3 files, databases, certificates, archives, and other common file types on local drives and mapped network drives; some reporting also notes mounted backups can be encrypted. CryptoLocker commonly arrives via phishing and spam campaigns, including ZIP attachments containing executables disguised as PDF files, and was also distributed through watering-hole attacks and by the Gameover Zeus botnet/Zbot infections. It persists from randomly named executables in %AppData% or %LocalAppData% using Run/RunOnce registry entries, records encrypted files in the registry, and attempts to delete Shadow Volume Copies via vssadmin. Payment methods mentioned in the content include Bitcoin, MoneyPak, prepaid cards, Ukash, and cashU, with ransom amounts commonly cited around $100 to $300, though some victims reportedly paid more. The malware was heavily associated with Gameover Zeus and the criminal enterprise tied by U.S. authorities to Evgeniy Mikhailovich Bogachev; DOJ and related reporting state GOZ was a primary vehicle for seeding CryptoLocker infections. Reported impact figures in the content include more than 234,000 infected computers, including over 117,000 in the United States, and more than $27 million in ransom payments in its first two months online. Targeting was global, with the United States specifically noted as heavily affected and business users frequently impacted; examples include an insurance company in Pittsburgh and a Massachusetts police department. Law-enforcement and private-sector disruption during Operation Tovar/Gameover in June 2014 seized or neutralized infrastructure associated with CryptoLocker, after which the original CryptoLocker distribution network was disabled. Notable indicators and artifacts directly mentioned in the content include registry paths such as HKEY_CURRENT_USER\Software\CryptoLocker\Files and HKEY_CURRENT_USER\Software\CryptoLocker_0388\Files, autostart entries under HKCU\Software\Microsoft\Windows\CurrentVersion\Run or RunOnce, execution from %AppData% or %LocalAppData%, use of DGA-generated domains, and the command to delete shadow copies: vssadmin Delete Shadows /All /Quiet.