Malware

CryptoHost

Tracked since Aug 14, 2026 · Updated 3 months ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 daysNo mention activity in the last 30 days.

Vulns0Associated

Actors0Associated

ATT&CK9Techniques

IOCs0Tracked

Is this in your environment?See whether this family's indicators match your telemetry and which of your assets are exposed to the CVEs associated with it.

Check your exposure

MITRE ATT&CK

Techniques & procedures

9 distinct techniques documented for this family, organized by ATT&CK tactic.

Persistence

3 techniques

T1112Modify RegistryEvidence1

When first started CryptoHost will also try to delete the HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot key in order to make it impossible to boot into safe mode.

T1547Boot or Logon Autostart ExecutionEvidence1

It will also create an autorun called software that executes the ransomware on login.

T1547.001Registry Run Keys / Startup FolderEvidence1

It will also create an autorun called software that executes the ransomware on login... HKCU\Software\Microsoft\Windows\CurrentVersion\Run\software %AppData%\cryptohost.exe

Privilege Escalation

2 techniques

T1547Boot or Logon Autostart ExecutionEvidence1

It will also create an autorun called software that executes the ransomware on login.

T1547.001Registry Run Keys / Startup FolderEvidence1

It will also create an autorun called software that executes the ransomware on login... HKCU\Software\Microsoft\Windows\CurrentVersion\Run\software %AppData%\cryptohost.exe

Stealth

2 techniques

T1036MasqueradingEvidence1

CryptoHost is currently being bundled with a uTorrent installer that when installed extracts the cryptohost.exe to the %AppData% folder and executes it.

T1497Virtualization/Sandbox EvasionEvidence1

CryptoHost will also monitor process names and Window titles for certain strings. If these strings are detected the associated process will be terminated.

Defense Impairment

2 techniques

T1112Modify RegistryEvidence1

When first started CryptoHost will also try to delete the HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot key in order to make it impossible to boot into safe mode.

T1685Disable or Modify ToolsEvidence1

CryptoHost will also monitor process names and Window titles for certain strings. If these strings are detected the associated process will be terminated.

Discovery

1 technique

T1497Virtualization/Sandbox EvasionEvidence1

CryptoHost will also monitor process names and Window titles for certain strings. If these strings are detected the associated process will be terminated.

Collection

1 technique

T1560.001Archive via UtilityEvidence1

Once executed, CryptoHost will move all files that match certain extensions into a password protected RAR archive located in the %AppData% folder.

Impact

2 techniques

T1486Data Encrypted for ImpactEvidence3

The file encrypter typically searches for files on the system based on their file extensions, encrypts each file one by one and renames it, e.g., by adding an extension.

T1657Financial TheftEvidence1

Paying the ransom is no guarantee that the data will be decrypted again by the attackers. An extortioner can suddenly demand more money to release the data... The payment demanded is generally made via e-Payment systems that provide anonymised accounts and payment methods - in the current case: Bitcoin.

Activity feed

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

View more in app →

g data software blogNews · Feb 25, 2021Ransomware identification for the judicious analyst TechBlogA ransomware example described as using password-protected archives to encrypt and store files.Read more ↗bleeping computerNews · Apr 8, 2016CryptoHost Decrypted: Locks files in a password protected RAR FileCryptoHost is a ransomware family that pretends to encrypt victim files but actually moves targeted files into a password-protected RAR archive in %AppData%. It demands 0.33 bitcoins for recovery, checks blockchain.info for exact payment confirmation, establishes persistence via a Run key, attempts to hinder Safe Mode recovery, and terminates processes associated with security tools and common user applications/sites.Read more ↗

Is this in your environment?See whether this family's indicators match your telemetry and which of your assets are exposed to the CVEs associated with it.

Check your exposure

Mallory platform

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start Free Trial Open in App ↗

IOC matchingMatch every observed IP, domain, and hash against your live telemetry.

Associated threat actorsGroups linked to this family, with evidence pinned to each claim.

Associated vulnerabilitiesCVEs linked to this family, with the reporting behind each link.

Detection signaturesYARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping9Every documented technique, ranked by evidence weight.

Researcher chatterReddit, Mastodon, and CTI community discussion around this family.

CryptoHost

Tracked since Aug 14, 2026 · Updated 3 months ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 daysNo mention activity in the last 30 days.

Vulns0Associated

Actors0Associated

ATT&CK9Techniques

IOCs0Tracked

Is this in your environment?See whether this family's indicators match your telemetry and which of your assets are exposed to the CVEs associated with it.

Check your exposure