malware family

File-Locker

unknownentity:malware_familyransomware · 1 source

The File-Locker Ransomware is a Hidden Tear variant that is targeting victims in Korea. When victim's are infected it will leave a ransom requesting 50,000 Won, or approximately 50 USD, to get the files back. This ransomware uses AES encryption with a static password of "dnwls07193147", so it is easily decryptable.

Curated · btcintel

claims we make, each with its source and citation · sources may contradict; we show the set, never a score

Facts

id: file-locker
kind: malware family
status: unknown
aliases: —
jurisdictions: —
claims naming it: 443 · 0 attributions · 0 relations · 0 events

Identifiers

misp-galaxy c06a1938-dcee-11e8-bc74-474b0080f0e5via misp-galaxy-ransomware

Relations

computedno relations recorded for this entity

Events

computedno dated events recorded for this entity

Claims naming this entitynewest first · 20 of 443

File-Lockerransomwarepayment
subjecttransaction86d92c9905…384865a237
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1BoatSLRHtKNngkdXEeobR76b53LETtpyT · 407,574 sat · time 2012-03-09 02:31 UTC · url https://ransomwhe.re/#address/1BoatSLRHtKNngkdXEeobR76b53LETtpyT
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_25519btcintel:annotations:25519@v3 sha256:999589cd62cebcdf
confidencetrusted provider · 50
File-Lockerransomwarepayment
subjecttransaction8baf1080db…9f215ed18a
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1BoatSLRHtKNngkdXEeobR76b53LETtpyT · 50,000 sat · time 2012-08-07 10:51 UTC · url https://ransomwhe.re/#address/1BoatSLRHtKNngkdXEeobR76b53LETtpyT
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_25518btcintel:annotations:25518@v3 sha256:f2aad781dcc3a1fb
confidencetrusted provider · 50
File-Lockerransomwarepayment
subjecttransaction6fa76d939d…40110350ca
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1BoatSLRHtKNngkdXEeobR76b53LETtpyT · 50,000 sat · time 2012-10-16 06:15 UTC · url https://ransomwhe.re/#address/1BoatSLRHtKNngkdXEeobR76b53LETtpyT
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_25517btcintel:annotations:25517@v3 sha256:b55723079dd5353b
confidencetrusted provider · 50
File-Lockerransomwarepayment
subjecttransactioneb58b85843…0fd09052ba
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1BoatSLRHtKNngkdXEeobR76b53LETtpyT · 1,000,000 sat · time 2012-12-30 07:32 UTC · url https://ransomwhe.re/#address/1BoatSLRHtKNngkdXEeobR76b53LETtpyT
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_25516btcintel:annotations:25516@v3 sha256:f1c85161fc35830f
confidencetrusted provider · 50
File-Lockerransomwarepayment
subjecttransactiona84fc1032e…219a4a6850
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1BoatSLRHtKNngkdXEeobR76b53LETtpyT · 100,000 sat · time 2013-06-09 19:47 UTC · url https://ransomwhe.re/#address/1BoatSLRHtKNngkdXEeobR76b53LETtpyT
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_25515btcintel:annotations:25515@v3 sha256:3ca2f268f20c8e23
confidencetrusted provider · 50
File-Lockerransomwarepayment
subjecttransaction6f01d9c7db…a2b8e28644
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1BoatSLRHtKNngkdXEeobR76b53LETtpyT · 500,000 sat · time 2014-03-02 01:35 UTC · url https://ransomwhe.re/#address/1BoatSLRHtKNngkdXEeobR76b53LETtpyT
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_25514btcintel:annotations:25514@v3 sha256:c0a477dbe7784abf
confidencetrusted provider · 50
File-Lockerransomwarepayment
subjecttransactionb30679bf3c…9486c1e5f3
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1BoatSLRHtKNngkdXEeobR76b53LETtpyT · 1,000 sat · time 2014-09-04 23:50 UTC · url https://ransomwhe.re/#address/1BoatSLRHtKNngkdXEeobR76b53LETtpyT
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_25513btcintel:annotations:25513@v3 sha256:06e84036ddcd82dc
confidencetrusted provider · 50
File-Lockerransomwarepayment
subjecttransaction9437073dbd…abf2ac405d
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1BoatSLRHtKNngkdXEeobR76b53LETtpyT · 890,000 sat · time 2014-12-22 20:41 UTC · url https://ransomwhe.re/#address/1BoatSLRHtKNngkdXEeobR76b53LETtpyT
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_25512btcintel:annotations:25512@v3 sha256:b21f331e2b631d9f
confidencetrusted provider · 50
File-Lockerransomwarepayment
subjecttransactioncff9033df4…bbcf117268
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1BoatSLRHtKNngkdXEeobR76b53LETtpyT · 140,000 sat · time 2016-08-20 18:38 UTC · url https://ransomwhe.re/#address/1BoatSLRHtKNngkdXEeobR76b53LETtpyT
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_25511btcintel:annotations:25511@v3 sha256:23d77e1932762267
confidencetrusted provider · 50
File-Lockerransomwarepayment
subjecttransaction5ec1f508e8…e7bbeb4f1d
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1BoatSLRHtKNngkdXEeobR76b53LETtpyT · 11,426 sat · time 2016-08-30 23:57 UTC · url https://ransomwhe.re/#address/1BoatSLRHtKNngkdXEeobR76b53LETtpyT
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_25510btcintel:annotations:25510@v3 sha256:96a7ec50869b5794
confidencetrusted provider · 50
File-Lockerransomwarepayment
subjecttransaction5e5638460b…6707acf10a
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1BoatSLRHtKNngkdXEeobR76b53LETtpyT · 40,000 sat · time 2016-10-25 08:38 UTC · url https://ransomwhe.re/#address/1BoatSLRHtKNngkdXEeobR76b53LETtpyT
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_25509btcintel:annotations:25509@v3 sha256:445b34104259df45
confidencetrusted provider · 50
File-Lockerransomwarepayment
subjecttransaction68937eb3e8…3f987506d0
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1BoatSLRHtKNngkdXEeobR76b53LETtpyT · 107,419 sat · time 2016-12-21 13:18 UTC · url https://ransomwhe.re/#address/1BoatSLRHtKNngkdXEeobR76b53LETtpyT
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_25508btcintel:annotations:25508@v3 sha256:0a5a2b3df7611a60
confidencetrusted provider · 50
File-Lockerransomwarepayment
subjecttransactionb42f8d49fe…7c1d175933
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1BoatSLRHtKNngkdXEeobR76b53LETtpyT · 100,000 sat · time 2017-01-07 14:25 UTC · url https://ransomwhe.re/#address/1BoatSLRHtKNngkdXEeobR76b53LETtpyT
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_25507btcintel:annotations:25507@v3 sha256:d805e12a4d5af583
confidencetrusted provider · 50
File-Lockerransomwarepayment
subjecttransaction0b8ab05d23…679f002181
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1BoatSLRHtKNngkdXEeobR76b53LETtpyT · 1,000,000 sat · time 2017-02-16 23:24 UTC · url https://ransomwhe.re/#address/1BoatSLRHtKNngkdXEeobR76b53LETtpyT
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_25506btcintel:annotations:25506@v3 sha256:2de62325091f8283
confidencetrusted provider · 50
File-Lockerransomwarepayment
subjecttransactioneac9896343…ee40a8719c
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1BoatSLRHtKNngkdXEeobR76b53LETtpyT · 500,000 sat · time 2017-02-27 08:39 UTC · url https://ransomwhe.re/#address/1BoatSLRHtKNngkdXEeobR76b53LETtpyT
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_25505btcintel:annotations:25505@v3 sha256:ec422dbe5d27efc0
confidencetrusted provider · 50
File-Lockerransomwarepayment
subjecttransaction338fa9b410…60e9bd7731
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1BoatSLRHtKNngkdXEeobR76b53LETtpyT · 500,000 sat · time 2017-02-27 10:38 UTC · url https://ransomwhe.re/#address/1BoatSLRHtKNngkdXEeobR76b53LETtpyT
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_25504btcintel:annotations:25504@v3 sha256:e32d2fbfc507b50a
confidencetrusted provider · 50
File-Lockerransomwarepayment
subjecttransaction8eb20dd776…45debd7369
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1BoatSLRHtKNngkdXEeobR76b53LETtpyT · 500,000 sat · time 2017-02-27 10:38 UTC · url https://ransomwhe.re/#address/1BoatSLRHtKNngkdXEeobR76b53LETtpyT
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_25503btcintel:annotations:25503@v3 sha256:2859da704b2b8530
confidencetrusted provider · 50
File-Lockerransomwarepayment
subjecttransaction641a78cded…865156711a
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1BoatSLRHtKNngkdXEeobR76b53LETtpyT · 1,000,000 sat · time 2017-02-27 14:56 UTC · url https://ransomwhe.re/#address/1BoatSLRHtKNngkdXEeobR76b53LETtpyT
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_25502btcintel:annotations:25502@v3 sha256:004234f628f461c1
confidencetrusted provider · 50
File-Lockerransomwarepayment
subjecttransaction46f59312ac…615b503718
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1BoatSLRHtKNngkdXEeobR76b53LETtpyT · 500,000 sat · time 2017-02-27 17:01 UTC · url https://ransomwhe.re/#address/1BoatSLRHtKNngkdXEeobR76b53LETtpyT
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_25501btcintel:annotations:25501@v3 sha256:876a5dba516d4117
confidencetrusted provider · 50
File-Lockerransomwarepayment
subjecttransaction3afda2c7d2…c5077ae2d6
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1BoatSLRHtKNngkdXEeobR76b53LETtpyT · 1,000,000 sat · time 2017-02-28 02:33 UTC · url https://ransomwhe.re/#address/1BoatSLRHtKNngkdXEeobR76b53LETtpyT
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_25500btcintel:annotations:25500@v3 sha256:566b4aeb7591f13a
confidencetrusted provider · 50

Subjects443 subjects carry a claim naming this entity · a sample

Community

notes from Nostr labelers · never merged with the bands above · not endorsed

Community content is indexed from Nostr and not endorsed by btcintel.

not computed yetNot indexed yet: the community index has not looked at this subject.