{
  "family": "virlock",
  "sample_count": 3132,
  "category": "ransomware_file_infector",
  "description": "VirLock (also known as VirLocker) is a polymorphic parasitic file infector that doubles as ransomware. As documented in a Virus Bulletin (VB2015) analysis, it transforms the files it infects into new copies of itself, so each infected file becomes both a carrier of the malware and a payload. Alongside this file-infecting behaviour it employs screen-locking, presenting a lock screen that demands payment before the system can be used. This combination of self-replicating file infection with extortion made VirLock an early and unusual example of a ransomware/file-infector hybrid.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "VirLocker",
    "Virlock"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What type of malware is VirLock?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "VirLock is a hybrid threat: it is both a polymorphic parasitic file infector and ransomware. It spreads by infecting files and also locks the screen to demand payment."
      }
    },
    {
      "@type": "Question",
      "name": "How does VirLock spread?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "VirLock transforms the files it infects into copies of itself. Each infected file then acts as a carrier, so opening or sharing an infected file can propagate the malware further."
      }
    },
    {
      "@type": "Question",
      "name": "Why is VirLock described as polymorphic?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "VirLock changes its own code as it replicates, producing varied copies. This polymorphism is intended to make detection by simple signature matching more difficult."
      }
    },
    {
      "@type": "Question",
      "name": "What does VirLock do to an infected computer?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "In addition to infecting files, VirLock uses a screen-locking technique that blocks normal use of the system and presents an extortion demand, consistent with ransomware behaviour."
      }
    }
  ],
  "faq_count": 4,
  "mitre_attack": [
    "T1486",
    "T1027"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-11",
  "sources": [
    {
      "name": "Virus Bulletin: \"VB2015 paper: It’s A File Infector... It’s Ransomware... It’s Virlock\" (Nacu, Androinic, Craciun)",
      "url": "https://malpedia.caad.fkie.fraunhofer.de/details/win.virlock"
    }
  ],
  "target_industries": [
    "Healthcare",
    "Critical Infrastructure",
    "Enterprise"
  ],
  "motivation": "Financial Extortion",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}