Cryptos

Overview

Ransomware:Win32/Cryptos is a generic heuristic detection used by antivirus engines to identify early, varied, or obfuscated forms of encryption-based ransomware. While it may not pinpoint a specific famous family (like LockBit or Ryuk), a Cryptos alert signifies a critical event: an executable is actively attempting to utilize cryptographic APIs to mass-encrypt the user's files and extort a ransom payment for the decryption key.

Understanding Cryptos Heuristics
To a victim, a Cryptos infection is a catastrophic event. Files suddenly change extensions (e.g., `.locked`, `.crypt`), become inaccessible, and a ransom note (usually a `.txt` or `.html` file) appears on the desktop demanding cryptocurrency. For a security analyst, this alert means perimeter defenses failed, the payload executed, and the race to stop the encryption process is on. Generic heuristics trigger on the *behavior* of rapid file modification combined with the use of Windows CryptoAPI.

Execution and Encryption Mechanics
Ransomware flagged as Cryptos is typically delivered via phishing emails (`T1566.001`), exploit kits, or deployed manually by attackers after moving laterally. Upon execution (`T1204.002`), it establishes persistence (often via Registry Run keys) and attempts to disable volume shadow copies and backups (`vssadmin.exe delete shadows`) (`T1490`). It then iterates through all local drives and mapped network shares, targeting specific file extensions (documents, databases, pictures) (`T1083`). It utilizes strong encryption (like AES or RSA) (`T1486`) to lock the files, overwriting the originals or creating encrypted copies and deleting the originals.

Indicators of Compromise & Impact
The impact is total data loss and massive business disruption. The primary IoC is an overwhelming surge in file modification events (writes/renames) across the disk. EDR logs will flag the execution of `vssadmin.exe` or `bcdedit.exe` to inhibit system recovery. Network logs may show the malware reaching out to a C2 server to transmit the unique encryption key before the ransom note is displayed.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to our technical analysis hubs and the official MITRE ATT&CK framework:

MITRE D3FEND™ Defensive Countermeasures

Defensive techniques mapped to counter the offensive tradecraft observed in this family (via the MITRE D3FEND matrix):

Tiered Detection Rules (Cisco CAIRN Model)

Modern threat detection requires multi-layered rule engineering. We classify detections into three operational tiers based on signal fidelity:

rule MALWARE_WIN_CRYPTOS_T1_ARTIFACT {
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cryptos"
        tier = "T1 - Primitive Artifact"
        confidence = "Low-Medium (Fast Triage)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        $s1 = "cryptos" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

title: SystemHelpDesk Detection - Cryptos (Ransomware) Execution & Triage
id: e35795e7-111e-57f0-91f4-c4fce4ecc573
status: production
description: Detects execution, defense evasion, and persistence behaviors associated
  with the Cryptos malware family. Detects volume shadow copy deletion, boot status
  tampering, and recovery inhibition characteristic of modern ransomware operations.
references:
- https://malware-families-catalog.systemhelpdesk.com/families/cryptos
- https://malware-families-catalog.systemhelpdesk.com/defensive/ransomware-protection
- https://malware-families-catalog.systemhelpdesk.com/
author: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP
date: '2026-10-14'
modified: '2026-10-14'
tags:
- attack.ransomware
- author.ricky-jordan
- source.systemhelpdesk-mfc
- attack.t1083
- attack.t1204_002
- attack.t1486
- attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection_process:
    Image|endswith:
    - \vssadmin.exe
    - \wmic.exe
    - \wbadmin.exe
    - \bcdedit.exe
    CommandLine|contains:
    - delete shadows
    - shadowcopy delete
    - resize shadowstorage
    - recoveryenabled no
    - ignoreallfailures
  condition: selection_process
falsepositives:
- Legitimate enterprise administrative scripts during approved change windows
- Authorized IT software deployment utilities and backup management agents
level: critical

rule MALWARE_WIN_CRYPTOS_T3_ATTRIBUTION {
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cryptos tradecraft"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        // Core family identifier & heuristic payload signatures
        $attrib_str = "cryptos" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker = "http" ascii nocase
    condition:
        uint16(0) == 0x5a4d and ($attrib_str and $net_marker) and filesize < 15MB
}

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Immediately disconnect the infected endpoint from the corporate network and physically unplug the network cable to prevent the ransomware from encrypting shared network drives.
2. Do NOT turn off or reboot the machine immediately; capture a live memory dump (RAM) first, as poorly written ransomware sometimes leaves the encryption keys in memory.
3. Identify the specific ransomware family using the ransom note or file extensions (e.g., via ID Ransomware) to see if a free decryptor exists.
4. Initiate the enterprise Disaster Recovery (DR) plan; completely wipe the infected machine and restore data from a clean, offline backup.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do NOT pay the ransom; it funds cybercrime, and there is no guarantee the attackers will provide a working decryption tool.
2. Avoid connecting external hard drives or USBs to the infected machine to 'save' files; the ransomware will instantly encrypt the external drive as well.

References & External Analysis

• Search "cryptos" on VirusTotal (External Analysis)
• Search "cryptos" on Any.Run (Sandbox Sandbox)
• Search "cryptos" on MalwareBazaar (Malware Samples)

Frequently Asked Questions

Related Threats (Category: Ransomware)

Explore other documented threats in the same operational category:

• Ilomo
• Randrew
• Globeimposter
• Zloyfly
• Idsohtu
• Lozer
• Maesorn
• Zombieboy

Machine-readable

Get this profile as JSON: https://malware-families-catalog.systemhelpdesk.com/api/cryptos.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.