CryptoLuck, also seen as YafunnLocker, is a Windows ransomware strain from November 2016 that spread through the RIG-E exploit kit. A self-extracting archive drops a legitimate signed GoogleUpdate.exe into %AppData%\76ff, which then loads a malicious goopdate.dll. Files are encrypted with AES-256 and RSA-2048 and renamed with the victim ID and _luck, giving names like photo.jpg.04FF8160_luck. Each note is named [@]WARNING_FILES_ARE_ENCRYPTED. plus the ID and .txt, and a Decryptor Wizard window asks up to 2.1 BTC within 72 hours. Contact addresses seen include YAFUNN[@]YAHOO.COM, FRAMOZES[@]YANDEX.RU and bortanofe[@]hotmail.com. It hits single Windows machines and their documents, databases, images and game files. The note makes no theft claim, and no leak site is linked to it.
Decryptor: No public decryptor was found. Checked 2026-10-13.
Data exfiltration risk: Undocumented — The CryptoLuck note demands payment for a private key and says nothing about copying data. No theft or leak site has been tied to it.
Systems typically targeted: Windows computers reached through exploit-kit drive-by downloads, where it encrypts documents, databases, images, game saves and archives on local and network drives.
Do this first: CryptoLuck runs through a signed GoogleUpdate.exe loading a rogue goopdate.dll from %AppData%\76ff, so preserve that folder for analysis. Keep the note, which holds the victim ID and contact address. Restore from backups made before the infection.
Dealing with an active incident? Our incident response team is available 24/7.
Emergency response: +1 (877) 364-5161