Crystal Rans0m: Hybrid ransomware with stealer capabilities
Essential information
- Published
- 21/10/2024 11:04
- Modified
- 21/10/2024 11:24
- Tags
- 2024-10-21 anti-vm crystal rans0m discord hybrid ransomware monero rust session stealer
- Related entities
- 5 observables, 7 techniques (mitre), 1 malware, 14 others
Description
Crystal Rans0m is a newly discovered hybrid ransomware family developed in Rust, first observed in September 2023. It combines file encryption with data stealing capabilities, doubling its leverage over victims. The malware targets browser data, Discord tokens, Steam files, and Riot Games data. It uses Discord webhooks for exfiltration and Salsa20 for file encryption. The ransom note demands payment in Monero and provides a Session ID for communication. Crystal Rans0m employs anti-VM and anti-debugging techniques. Recent samples suggest it may be modular, allowing attackers to choose specific components. While initially seen targeting Italy and Russia, its motivation appears to be financial gain without specific geographic or industry focus.