CryptoHost Ransomware Hid Files in Password-Protected RAR Archives

Researchers identified CryptoHost, also tracked as Manamecrypt, as a ransomware family that did not truly encrypt files but instead moved targeted data into a password-protected RAR archive and demanded 0.33 Bitcoin for recovery. The malware reportedly stored both the archive and its executable under AppData\Roaming, established persistence through a Run registry key, and verified exact ransom payments through blockchain.info before releasing files. It was also reported as being bundled with a uTorrent installer and detected by security products as Ransom:MSIL/Manamecrypt.A and Ransom_CRYPTOHOST.A.

Analysis of the malware showed the archive password was generated predictably from the archive name and the victim username, allowing affected files to be recovered without paying the ransom. Researchers also said the threat attempted to frustrate remediation by deleting the SafeBoot registry key and terminating processes associated with security tools, administration, gaming, shopping, and social-media applications. While some reports described the attacks as highly disruptive for users and companies, they also warned that ransom payment via Bitcoin remained risky and offered no guarantee of successful recovery, reinforcing the need for preventive security controls and backups.