- Home
Detectable Ransomware CryptXXX
Ransomware Research
CryptXXX Ransomware
CryptXXX is a malicious ransomware strain that encrypts victim files and demands ransom payment for decryption. First observed in the wild on April 1, 2016, this ransomware has been actively targeting systems worldwide. Security researchers also track this malware under the aliases: CryptXXX 2.0.
Quick Facts
- Ransomware Family
- CryptXXX
- First Seen
- April 1, 2016
- Known Aliases
- CryptXXX 2.0
How CryptXXX Ransomware Works
Targeted Files
https://hummingbird.tistory.com/6410 https://app.any.run/tasks/1d8d1d05-07f4-4aef-812a-63675109f991/ https://www.sentinelone.com/blog/sophisticated-new-packer-identified-in-cryptxxx-ransomware-sample/ https://www.fortinet.com/blog/threat-research/cryptxxx-ransomware-emerges-for-a-slice-of-the-pie e40f89a16e44a65b53864fdfaa9dd70fc08382dcb2f3941d986056d2c50923ac -> XMS1, XMS2 export d88e1d4e38015ba121182b8d3288dd6b1e5deaf66430633d96802992414b856d -> MS1, MS2 export c87a3e7901defac48f531367d45306b7b2df33752b4a37f3744e029898bd1c1c -> MXS2 22fa2fc686d503d2ecef115f71e01bbae0f4a66e3c1550c39772065961037a16 -> AccessToken
File Encryption Patterns
CryptXXX modifies encrypted files using specific patterns to mark them as encrypted:
File extensions added after encryption:
..crypt
..crypz
..cryp1
Ransom Note and Payment Demands
After encrypting files, CryptXXX displays ransom notes demanding payment for file recovery:
!README.HTML
Ransom message:
notes/!README.HTML
Note locations:
EveryFolder
de_crypt_readme.txt
Ransom message:
notes/de_crypt_readme.txt
Note locations:
EveryFolder
decrypt-instructions.txt
Ransom message:
notes/decrypt-instructions.txt
Note locations:
EveryFolder
decrypt-instructions.html
Ransom message:
notes/decrypt-instructions.html
Note locations:
EveryFolder
decrypt-instructions.bmp
Ransom message:
notes/decrypt-instructions.bmp
Note locations:
EveryFolder
/^@[A-F0-9]{12}\.html$/
Ransom message:
notes/@52CE675AD85E.html
Note locations:
EveryFolder
/^@[A-F0-9]{12}\.txt$/
Ransom message:
notes/@52CE675AD85E.txt
Note locations:
EveryFolder
/^![A-F0-9]{12}\.html$/
Ransom message:
notes/!4B3A1BD0EC11.html
Note locations:
EveryFolder
/^![A-F0-9]{12}\.txt$/
Ransom message:
notes/!4B3A1BD0EC11.txt
Note locations:
EveryFolder
Technical Indicators
Associated Executable Files
The following executable files are associated with CryptXXX ransomware:
layouts.exe
adc0.tmp.dll
3363.tmp.dll
rad30AF9.tmp.dll
rad24cd3.tmp.dll
rad5E0FA.tmp.dll
Elastio Can Help You
Don't let CryptXXX ransomware take over your data
Elastio provides advanced ransomware protection and recovery solutions to keep your organization safe.
About This Analysis
This CryptXXX ransomware analysis is part of Elastio's comprehensive ransomware detection database. Elastio provides advanced ransomware protection and recovery solutions, helping organizations defend against and recover from ransomware attacks like CryptXXX.
Last updated: July 30, 2025