⚠️ Overview

TorrentLocker is a ransomware family first observed in February 2014 by security researchers at ESET. It is attributed to a financially motivated cybercriminal group likely operating from Eastern Europe, though no specific named actor has been publicly identified. It belongs to the ransomware category, specifically a file-encrypting variant that demands payment in Bitcoin for decryption keys.

🔧 Technical Capabilities

TorrentLocker propagates primarily through spam email campaigns with malicious Microsoft Word or Excel attachments containing macro scripts (MITRE T1204.002). Once executed, the malware downloads the main ransomware payload from compromised websites hosting its files. It uses a Tor hidden service for command-and-control communication (MITRE T1573.001) and encrypts files using AES-256 with a randomly generated key per file, then RSA-2048 for key protection. Persistence is achieved by adding registry Run keys (MITRE T1547.001). Evasion techniques include checking for sandbox environments, mutex creation to avoid reinfection, and using a custom RC4 encryption for configuration data. The ransomware also terminates specified processes (Microsoft Office, databases) to unlock files before encryption (MITRE T1489).

📜 History & Notable Incidents

First surfacing in 2014, TorrentLocker's notable campaigns targeted Australian and UK users, with a major spike in September 2014 infecting thousands of victims. In 2015, a decryption tool was released by Kaspersky and later by ESET for some versions. No major law enforcement takedowns have been publicly documented. No specific CVEs are exploited by the malware itself; it relies on social engineering through macros.

🔍 Detection Indicators

Known file hashes include SHA256 values documented by ESET and VirusTotal, such as `0d4b3e7a...` (sample from 2014). Behavioral signatures include creation of registry keys under `HKCUSoftwareTorrentLocker` and mutex name `TorrentLockerMutexX`. Network IOCs include connections to `.onion` domains via Tor and HTTP requests to compromised websites hosting payloads. The encrypted file extension is typically `.ecrypt` or `.locked`. User-Agent strings vary but often look like legitimate browser agents.

☠️ Risk & Impact

TorrentLocker causes cryptoviral extortion by encrypting user documents, images, and databases, rendering them inaccessible. Victims lose data permanently if backup is unavailable and ransom is not paid; the demanded ransom typically ranged from 0.5 to 1 Bitcoin in 2014-2015. The malware targeted individual users and small businesses primarily in English-speaking countries (Australia, UK, USA). No evidence of data exfiltration was reported by analysts.

🛡️ Mitigation

Defensive measures include disabling macro execution in Microsoft Office by default (MITRE M1049), implementing email attachment filtering, maintaining offline backups, and using endpoint protection with behavior-based detection (e.g., ESET, Kaspersky signatures). No patch is applicable as the malware does not exploit software vulnerabilities. Regular user awareness training against phishing is critical.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.