Crysis

Overview

Ransomware:Win32/Crysis (widely tracked in subsequent major evolutionary variants as Dharma) is a prolific, destructive Ransomware-as-a-Service (RaaS) that emerged in early 2016 following the sunset of TeslaCrypt. Crysis specializes in targeted intrusions against small-to-medium-sized businesses, municipal governments, and healthcare facilities. Rather than relying solely on indiscriminate email spam, Crysis affiliates heavily exploit exposed and weak Remote Desktop Protocol (RDP) credentials (port 3389) via brute-force dictionary attacks. Once gaining initial access, operators manually reconnaissance the victim network, terminate security and backup processes using utility tools like GMER or Process Hacker, execute vssadmin.exe to purge Volume Shadow Copies, and deploy the Crysis executable. Crysis utilizes AES-128 or AES-256 for symmetric file encryption combined with RSA-1024 or RSA-2048 master keys, appending characteristic extensions such as .crysis, .dharma, .wallet, .onion, and .cesar. In November 2016 and May 2017, the original malware authors voluntarily posted master decryption keys to public forums on BleepingComputer, enabling security vendors including Kaspersky and ESET to release universal free decrypters through the global No More Ransom initiative.

Known aliases

Threat reports may refer to this family under multiple names:

• Crysis
• Dharma
• Ransom.Crysis
• Trojan-Ransom.Win32.Crusis
• W32/Crysis
• Ransom.Dharma

Threat Actor Attribution

Attribution is probabilistic, not a science. Each link below states its confidence level and the evidence behind it.

• Gold Southfield / Dharma Affiliates High confidence
  Basis:
• Russian-speaking Ransomware Operators High confidence
  Basis:

Family Pedigree & Lineage

Malware authors regularly fork and iterate upon existing codebases. Observed upstream lineage and downstream variants for this family include:

Known Derivatives & Downstream Variants: Crysis Original (.Crysis) · Dharma (.Dharma) · Wallet (.Wallet) · Onion (.Onion) · Cesar (.Cesar)

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to our technical analysis hubs and the official MITRE ATT&CK framework:

MITRE D3FEND™ Defensive Countermeasures

Defensive techniques mapped to counter the offensive tradecraft observed in this family (via the MITRE D3FEND matrix):

Exploited Vulnerabilities (CVEs)

This malware family is documented weaponizing the following common vulnerabilities and exposures:

• CVE-2017-0144 — In-depth exploitation analysis and catalog intelligence (NIST NVD ↗).
• CVE-2017-10271 — In-depth exploitation analysis and catalog intelligence (NIST NVD ↗).

Command & Control (C2) and Network Profile

How this family talks to its operators. C2 traffic can often identify a family even when its code and configuration are hard to analyse. Ports and patterns are historical and change between campaigns, so use them as hunting leads rather than block-only rules.

Indicators of Compromise

Public indicators drawn from CISA advisories and vendor reporting. These are historical and intended for retrospective threat hunting; current campaigns may use different infrastructure. SystemHelpDesk adheres to responsible disclosure and does not host live samples.

File hashes (SHA-256, sample)

Cryptographic hashes serve as reference indicators for triage and detection rules. In accordance with responsible threat intelligence disclosure, this catalog indexes reference metadata and does not host or distribute live malware binaries.

• 2bceba82a4d0cb53930b80985df7ff9f485dbbc0bb394d216bcda3865675fbb3
• 93bc928f62fa2277d13e9a5c88b0a996df7e20b336a5b6bb98ec2a66e6027f6a

Delivery vectors

• rdp_brute_force
• spearphishing_attachment

Persistence mechanisms

• HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
• Startup Folder

Tiered Detection Rules (Cisco CAIRN Model)

Modern threat detection requires multi-layered rule engineering. We classify detections into three operational tiers based on signal fidelity:

rule MALWARE_WIN_CRYSIS_T1_ARTIFACT {
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Crysis"
        tier = "T1 - Primitive Artifact"
        confidence = "Low-Medium (Fast Triage)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        $s1 = "crysis" ascii wide nocase
        $s2 = "crysis" ascii wide nocase
        $s3 = "dharma" ascii wide nocase
        $s4 = "ransom.crysis" ascii wide nocase
        $s5 = "trojan-ransom.win32.crusis" ascii wide nocase
        $s6 = "w32/crysis" ascii wide nocase
        $s7 = "ransom.dharma" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

title: SystemHelpDesk Detection - Crysis (Ransomware) Execution & Triage
id: 61e08b30-662e-5c44-ac78-bf08080142a5
status: production
description: Detects execution, defense evasion, and persistence behaviors associated
  with the Crysis malware family. Detects volume shadow copy deletion, boot status
  tampering, and recovery inhibition characteristic of modern ransomware operations.
references:
- https://malware-families-catalog.systemhelpdesk.com/families/crysis
- https://malware-families-catalog.systemhelpdesk.com/defensive/ransomware-protection
- https://malware-families-catalog.systemhelpdesk.com/
author: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP
date: '2026-10-14'
modified: '2026-10-14'
tags:
- attack.ransomware
- author.ricky-jordan
- source.systemhelpdesk-mfc
- attack.t1486
- attack.t1490
- attack.t1078_002
- attack.t1562_001
- attack.t1021_001
logsource:
  category: process_creation
  product: windows
detection:
  selection_process:
    Image|endswith:
    - \vssadmin.exe
    - \wmic.exe
    - \wbadmin.exe
    - \bcdedit.exe
    CommandLine|contains:
    - delete shadows
    - shadowcopy delete
    - resize shadowstorage
    - recoveryenabled no
    - ignoreallfailures
  condition: selection_process
falsepositives:
- Legitimate enterprise administrative scripts during approved change windows
- Authorized IT software deployment utilities and backup management agents
level: critical

rule MALWARE_WIN_CRYSIS_T3_ATTRIBUTION {
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Crysis tradecraft"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        // Core family identifier & heuristic payload signatures
        $attrib_str = "crysis" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker = "http" ascii nocase
    condition:
        uint16(0) == 0x5a4d and ($attrib_str and $net_marker) and filesize < 15MB
}

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Immediately disconnect affected hosts from local LAN and remote access tunnels.
2. Disable exposed public RDP endpoints and reset all local and domain administrator credentials.
3. Verify whether encrypted files match the Crysis master key database on No More Ransom before considering restoration.
4. Restore critical data systems from tested, disconnected offline backups.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Never expose port 3389 (RDP) directly to the public internet without an encrypted VPN and MFA.
2. Do not delete ransomware ransom notes or encrypted sample files required for decryption tool matching.
3. Never pay extortion demands prior to verifying whether public cryptographic keys decrypt the target files.

References & External Analysis

• ESET Research: Crysis Ransomware Technical Analysis and Decryptor
• No More Ransom Project Crysis Portal
• NIST National Vulnerability Database CVE-2017-0144
• Search "crysis" on VirusTotal (External Analysis)
• Search "crysis" on Any.Run (Sandbox Sandbox)
• Search "crysis" on MalwareBazaar (Malware Samples)

Frequently Asked Questions

Related Threats (Category: Ransomware)

Explore other documented threats in the same operational category:

• Jo0Br8Hglsii
• Buhtrap
• Rupttass
• Genericrxdm
• Whimoo
• Krament
• Mkar
• Naprat

Machine-readable

Get this profile as JSON: https://malware-families-catalog.systemhelpdesk.com/api/crysis.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.