CryptoLocker is a trojan horse, a new variant of ransomware malware, which targets computers that running Microsoft Windows. According to BBC's report , the first versions of CrytpoLocker appear to have been posted to the internet on 5 September 2013, and at the time of Christmas 2013, about 250,000 PCs have been infected already.

CryptoLocker encrypts various files on user’s computer and on mounted network drives, and it demands the owner of the files to pay the malware author in order to decrypt the files within a given time. It scans the computer and the mounted network drives according to an extension list to discover certain files to 'infect'. Affected files include documents, pictures, databases and many others.

The ransom was 100 USD/100 EUR/similar amount at first, then raised to 300 USD/300 EUR or 2 Bitcoin later.


Wikipedia has already done a nice brief of the operation of CryptoLocker. I'll cite some useful information here.

CryptoLocker typically propagates as an attachment to a seemingly innocuous e-mail message, which appears to have been sent by legitimate company; or, it is uploaded to a computer already recruited to a botnet by a previous Trojan infection. A ZIP file attached to an email message contains an executable file with the filename and the icon disguised as a PDF file, taking advantage of Windows' default behaviour of hiding the extension from file names to disguise the real .EXE extension. Some instances may actually contain the Zeus trojan instead, which in turn installs CryptoLocker.1)2) When first run, the payload installs itself in the Documents and Settings folder with a random name, and adds a key to the registry that causes it to run on startup. It then attempts to contact one of several designated command and control servers; once connected, the server then generates a 2048-bit RSA key pair, and sends the public key back to the infected computer. The server may be a local proxy and go through others, frequently relocated in different countries to make tracing difficult.The payload then proceeds to begin encrypting files across local hard drives and mapped network drives with the public key, and logs each file encrypted to a registry key. The process only encrypts data files with certain extensions.The payload then displays a message informing the user that files have been encrypted, and demands a payment within a certain time, or else the private key on the server would be destroyed, and “nobody and never will be able to restore files.”Payment of the ransom allows the user to download the decryption program, which is pre-loaded with the user's private key.

Symantec estimated that 3% of users infected by CryptoLocker chose to pay.3) Some victims claimed that, even with payment, their files were not decrypted.4)

In November 2013, the operators of CryptoLocker launched an online service which claims to allow users to decrypt their files without the CryptoLocker program, and to purchase the decryption key after the deadline expires; the process involves uploading an encrypted file to the site as a sample, and waiting for the service to find a match, which the site claims would occur within 24 hours. Once a match is found, the user can pay for the key online; if the 72-hour deadline has passed, the cost increases to 10 Bitcoin.5)6)

Extension List

According to AVIRA , here is the complete list of file extensions that the malware searches in order to encrypt: 3fr, accdb, ai, arw, bay, cdr, cer, cr2, crt, crw, dbf, dcr, der, dng, doc, docm, docx, dwg, dxf, dxg, eps, erf, indd, jpe, jpg, kdc, mdb, mdf, mef, mrw, nef, nrw, odb, odm, odp, ods, odt, orf, p12, p7b, p7c, pdd, pef, pem, pfx, ppt, pptm, pptx, psd, pst, ptx, r3d, raf, raw, rtf, rw2, rwl, srf, srw, wb2, wpd, wps, xlk, xls, xlsb, xlsm, xlsx.

How terrible! If you are working with Microsoft Windows, you may find out that almost every common extension your daily work deals with, is in that list.

Interestingly, the common extensions of source code files, such as c, cpp, py, java, and so on, are not in the list. Oh, plus, even no txt! I guess, there may be two reasons. First, though such files are valuable and worth kidnapping, they are usually under control of version management system, such as SVN, GIT, so it is easy to recover them. Second, the criminal, author of CryptoLocker, is probably a programmer himself/herself. Maybe he/she does not want to harm those who write programs as well, and maybe he/she is afraid that if he/she harms other programmers, all the other programmers might unite together to fight back.

Well, don't forget extensions for zipped files such as 7z, zip, rar. I don't figure out why they are not in the list. Perhaps the author thinks archived files are not as important as unarchived ones?


Ransomware malware has a long history. What makes CryptoLocker so different is that CryptoLocker uses a lot of trendy technologies to improve the malware operation, while inheriting the traditional idea of ransomware malware, thus make the crime to a new height.

We have to sigh again: technology is a double-edged sword , if falling into the wrong hand, the result would turn to be very evil and terrible.

In this section, I'll try to analyze and introduce some technologies CryptoLocker has used.



In the past, all encryption methods were in the same kind of patter:First, Party A selects a certain kind of rule to encrypt the information, then Party B uses the same rule to decrypt it.Because encryption and decryption use the same rule (which is referred as “key”), it is called Symmetric-key algorithm. The biggest weakness of Symmetric-key algorithm is that; Party A must tell Party B what the cryptographic rule (key) is, otherwise Party B can not decrypt. Preservation and transmission of the key has become the most troublesome.

In 1976, two American Computer Scientists Whitfield Diffie and Martin Hellman proposed a completely new idea which allows decryption without the need of direct transmission of key. This is called Diffie-Hellman key exchange. The basic idea is that two parties that have no prior knowledge of each other can jointly establish a shared secret key over an insecure communications channel, this key can then be used to encrypt subsequent communications using a symmetric key cipher. diffie-hellman.jpg

The idea of Diffie-Hellman exchange inspired other scientists. They started to realise that encryption and decryption could use different rules, so long as there is a mapping relationship existing between them. Thus direct transmission of key is avoided. This new mode is called Asymmetric cryptography.

The algorithm involves 3 steps: key generation, encryption and decryption.

  1. Party A generates a pair of keys – public key and private key.The public key is public to the public, so anyone could get it while private key is kept secretly by the owner.
  2. Party B acquires Party A's public key, and use it to encrypt the information.
  3. After receiving the encrypted message, Party A uses the private key to decrypt it.

If the information encrypted by the public key could only be decrypted by the private key, the communication is safe as long as the private key is not leaked.

In 1977, three mathematicians Rivest,Shamir and Adleman design an algorithm that implements Asymmetric cryptography. The algorithm is named as RSA after their names. Since then till now, RSA is always the most widely used asymmetric cryptography. It is no exaggeration to say that there is RSA algorithm where there is a computer network.



The key of the implementation of asymmetric cryptography is that to make sure that the message encrypted by the public key can and only can be decrypted by the private key. In RSA, this asymmetry is based on the practical difficulty of factoring the product of two large prime numbers, the factoring problem. A user of RSA creates and then publishes the product of two large prime numbers, along with an auxiliary value, as their public key. The prime factors must be kept secret. Whether breaking RSA encryption is as difficult as factoring is an open question known as the RSA problem.

Proofs could be achieved using Fermat's little theorem or Euler's theorem. I don't want to talk about too much of mathmatics, let's just remember the conclusion: this algorithm is very reliable, the longer the key is, the harder it is to crack.

According to the literatures that have been disclosed, the largest number factored by a general-purpose algorithm was a 768-bit long. In other words, the length of more than 768 can not be broken (at least no one publicly announced yet). So that 1024-bit RSA key is basic security and 2048-bit RSA key is extremly safe.

Why CryptoLocker not chose Symmetric-key algorithm

OK, talked about RSA-2048 so much, we know that RSA is widely used, RSA-2048 is the new trendy. Is that all? Is that why CryptoLocker uses RSA-2048, because it is fashion? Of course not. Choosing RSA-2048 I think is mainly based on two reasons:

  1. It is impossible to crack the algorithm.
  2. It is impossible to get the private key unless pay the ransom.

The first reason is easy to understand as long as you know the traits of RSA. The second reason is not hard to understand either.

If it is Symmetric-key algorithm that CryptoLocker chose to use, as mentioned before, Symmetric-key algorithm uses the same key in encryption and decryption, so there would be a possibility that the user of the computer notices CryptoLocker is encrypting their files, and captures the key in the memory. The key is both for encryption and decryption, so the user could decrypt the files CryptoLocker encrypted, there would be no need to pay the ransom.

In the case of RSA, even the user captures the key in the memory, it is the public key they capture, which is no help to decryption.

Therefore, Symmetric-key algorithm, such as AES(an algorithm that is also widely used and impossible to crack) would not be a good option for the criminal in this blackmail case.


Other possibilities

Botnet(Zombie Army)

DHT(Distributed Hash Table)

Criminal Psychology

Perfect Crime?!

Perfect Crime is a colloquial term. There is no precise definition. However, it is widely accepted that a crime could be called so if it is undetected by public, or , it is committed with sufficient planning and skill that no evidence is apparent, and the culprit cannot be traced.




You might ask why FBI have not caught the criminal yet? Well, I think because they are really unable to do so. You might continue to ask how is that possible? FBI have already brought down Silk Road, which is based on TOR. Well, let's talk a little bit more about FBI.


FBI and Silk Road

Case Study of VCF


This is what FBI uses in moive 'Batman: The Dark Knight Rises'. In other movies or TV series, we can see other similar user interfaces. All these imaginations indicate that what FBI uses should be a very powerful system, including massive information (avatar, fingerprints, criminal records, etc. ), perhaps providing functions such as Facial Recognition, Fuzzy Algorithm, Fingerprint Tracking, Intelligence Analysis, etc. as well. fbi_ui_in_movie.jpg

Unfortunately, fiction is just fiction. The reality is that at the beginning of 21st century, what FBI used looks like this.


From 1980 to 2001, FBI could not even guarantee one computer per office staff. Most of the computers were out of date, some were not connected to the internet. The software architecture and functions of the old system are really very old. Developed based on the technology of 1980s, and installed on-line in 1995. The architecture is based on IBM mainframes using IBM 3270 terminal access, user interface is a text based interface similar to DOS, the operating command is very cumbersome, and the database can not store photos and images.


The officers had to use the printer and scanner to handle images and photos of cases, and data entry work was very burdensome. Many officers simply did not want to use the computer system, but to use the paper forms instead.

Senior FBI officers deeply felt that how out of date they were. So they determined to change this passive situation. Therefore The Trilogy Project was born.

The Trilogy Project

In September 2000, Congress approved $379.8 million for a three year project that was called the FBI Information Technology Upgrade Project.(Yes, they did call it so, an UPGRADE,only an upgrade.) However, the FBI Information Technology Upgrade project was eventually divided into three parts and renamed Trilogy. These three parts are:

  • Purchase a large amount of high performance personal computer stations to update the FBI's antiquated computers.
  • Build a new computer network, so that all FBI's computers could connect to it.
  • Develop a core set of software. Through the organic system of software, hardware and networks, improve FBI's information processing and sharing capabilities and achieve a paperless office.

The third part is the heart of the project that would come to be known as VCF(Virtual Case File).

The Trilogy Project began in 2001. In June 2001, through competitive bidding, a company called SAIC (Science Applications International Corp ) defeated four other software vendors, gained the right to develop the VCF. At the beginning, the goal of the project was relatively practical and clear, the plan was upgrade(note that only upgrade) the original old FBI case file management system in the first three years, and the first year of this three-year plan was a budget of $14 million.

The Sentinel Project

QR Code
QR Code cryptolocker (generated for current page)