{
  "family": "crypt0l0cker",
  "sample_count": 2,
  "category": "ransomware",
  "description": "Ransomware:Win32/Crypt0l0cker is a highly destructive ransomware variant, often considered a direct clone or spiritual successor to the original, infamous CryptoLocker. It emerged around 2015 and specifically targeted Windows systems. Its primary objective is to encrypt user files using strong, unbreakable cryptography (typically AES-256 combined with RSA-2048) and demand payment, usually in Bitcoin, for the decryption key (`T1486`).<br><br><b>Understanding Crypt0l0cker</b><br>To an end-user, the infection is devastating: they suddenly find their documents, photos, and databases inaccessible, appended with random extensions, and a glaring ransom note (often `DECRYPT_INSTRUCTIONS.html` or `.txt`) displayed on the desktop. For a SOC, it represents a massive failure in preventative controls and necessitates immediate incident response to prevent lateral movement and further data loss.<br><br><b>Execution and Encryption Mechanics</b><br>Crypt0l0cker was primarily distributed via massive spam campaigns containing weaponized ZIP attachments, often leveraging botnets like Cutwail or using exploit kits (like Angler). Upon execution, it contacts a Command and Control (C2) server (often using Domain Generation Algorithms - DGA - to evade blocking) to obtain a unique public encryption key. It then scans all local drives and mapped network shares (`T1486`), encrypting files matching specific extensions (e.g., `.doc`, `.xls`, `.jpg`). Crucially, it attempts to delete Volume Shadow Copies (`vssadmin.exe Delete Shadows /All /Quiet`) to prevent easy restoration (`T1490`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is severe business disruption and data loss. Host-based IoCs include the presence of the ransom notes, files with altered extensions, execution of `vssadmin.exe` to delete shadow copies, and the malware establishing persistence via the `HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run` registry key. Network IoCs include outbound HTTP/HTTPS traffic to unknown, high-entropy domains (DGA) or known Tor exit nodes used for C2 communication.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1490",
    "T1566.001",
    "T1486",
    "T1568.002"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1486",
      "name": "Data Encrypted for Impact (The core ransomware functionality)",
      "tactic": "Impact"
    },
    {
      "id": "T1490",
      "name": "Inhibit System Recovery (Deleting Volume Shadow Copies)",
      "tactic": "Impact"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment (Primary delivery mechanism via malspam)",
      "tactic": "Initial Access"
    },
    {
      "id": "T1568.002",
      "name": "Dynamic Resolution: Domain Generation Algorithms (Using DGA for C2 resilience)",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Isolate the infected endpoint and IMMEDIATELY disconnect it from all network shares to prevent the ransomware from encrypting shared company drives.",
    "Do NOT turn off the machine immediately if possible; capture a live memory image, as the encryption keys might temporarily reside in RAM.",
    "Identify the entry vector (e.g., malicious email attachment) and purge it from the corporate email system to prevent further infections.",
    "Restore affected data from offline, immutable backups. Ensure the backups themselves were not compromised."
  ],
  "what_to_avoid": [
    "Do not pay the ransom unless absolutely necessary (e.g., life safety data); paying funds organized crime and does not guarantee data recovery.",
    "Avoid reconnecting the machine to the network until it has been completely wiped and the OS reinstalled from scratch."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}