Wlock

Overview

Executive Summary

Infection Vector and Technical Capabilities

• Screen Locking Mechanism: If operating as a locker, Wlock modifies the Windows Registry (often hijacking the `Winlogon\Shell` key) to load its own full-screen application instead of the standard `explorer.exe` desktop. This completely prevents the user from accessing the Start menu, taskbar, or any files.
• File Encryption (Crypto-variant): If operating as a standard crypto-ransomware, it rapidly enumerates the hard drive and network shares, encrypting documents, photos, and databases utilizing strong encryption algorithms (like AES or RSA). The original files are deleted, leaving only the encrypted versions.
• Extortion Demand: The malware displays a persistent, intimidating ransom note (often claiming to be from law enforcement or utilizing aggressive countdown timers) instructing the victim on how to purchase cryptocurrency and transfer the funds to the attacker.

Threat Assessment

Incident Response and Remediation

• Network Isolation: Disconnect the infected machine immediately to prevent the ransomware from spreading to mapped network drives or other devices on the LAN.
• Safe Mode Bypass (For Lockers): If Wlock is acting purely as a Screen Locker, booting the machine into "Safe Mode with Command Prompt" or using an offline bootable rescue disk can often bypass the locker application, allowing an administrator to remove the malicious registry keys and delete the executable.
• Data Restoration (For Crypto): If files have been encrypted, paying the ransom is strongly discouraged, as it funds criminal enterprises and does not guarantee a decryption key. The only reliable remediation is a complete wipe and re-image of the system, followed by data restoration from secure, offline backups.

Known aliases

Threat reports may refer to this family under multiple names:

• Ransomware.Wlock
• Trojan.Ransom.Wlock
• WinLock

MITRE ATT&CK Techniques

This family has been observed using the following ATT&CK techniques: T1486 T1489 T1547.004

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_WLOCK {
    meta:
        description = "Detects Wlock (ransomware)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "wlock" ascii wide nocase
        $s2 = "ransomware.wlock" ascii wide nocase
        $s3 = "trojan.ransom.wlock" ascii wide nocase
        $s4 = "winlock" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Wlock Activity
id: 1c108613bba5c1e321773baa82a234aa
status: experimental
description: Detects generic indicators of the wlock malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*wlock*"
            - "*ransomware.wlock*"
            - "*trojan.ransom.wlock*"
            - "*winlock*"
    condition: selection
level: medium

References & External Analysis

• Search "wlock" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: ransomware)

Explore other malware families in the same category:

• Scriptkd
• Manbat
• Pef13C
• Fakesupport
• Pccleaners

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/wlock.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.