Description
VirLock is ransomware and a polymorphic file infector that encrypts files and infects executable files on infected systems, demanding payment for decryption. Its dual behavior distinguishes it from ordinary ransomware, because cleaning requires both decryption and disinfection of every infected executable. The family spread through spam and shared storage in the mid 2010s, and its design made complete remediation unusually difficult.
Stats
- First seen
- January 2022
- Last seen
- October 2026
Also known as
Virlock
Alert name variants
| Alert Name |
|---|
| Dropped:Trojan.Ransom.VirLock.F |
| Dropped:Win32.Virlock.Gen.4 |
| Gen:Variant.Ransom.VirLock.100 |
| Gen:Variant.Ransom.VirLock.13 |
| Gen:Variant.Ransom.VirLock.131 |
| Gen:Variant.Ransom.VirLock.135 |
| Gen:Variant.Ransom.VirLock.42 |
| Gen:Variant.Ransom.VirLock.45 |
| Gen:Variant.Ransom.VirLock.46 |
| Gen:Variant.Ransom.VirLock.54 |
