RansomLock
Aliases: WinLock
- First seen
- 2012-12-01 00:00:00
- Malware type
- ransomware
- Family
- Malware family
- Last IoC activity
- 2026-07-21 21:55:44
- Profile updated
- 2026-07-07 13:39:17
Context
RansomLock, also known as WinLock, is a form of ransomware known for locking the desktop of infected computers. It targets users globally by preventing access to the desktop until a ransom is paid.
Detection coverage
- 1 YARA rules
Detection rules
- MALPEDIA_Win_Ransomlock_Auto (yara-rule)
Reports & references
- Broadcom/Symantec — Writeup.Jsp (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Ransomlock (report)
- forum.malekal.com — Viewtopic (report)
- Broadcom/Symantec — Writeup.Jsp (report)