Crusis

Overview

Ransomware:Win32/Crusis (heavily associated with, and often an alias for, the notorious Crysis/Dharma ransomware family) is a highly prolific, human-operated ransomware variant. Unlike automated worms, Crusis is deployed manually by attackers who have already breached the network, typically via compromised Remote Desktop Protocol (RDP) endpoints.

Understanding Crusis
To an end-user, a Crusis infection is catastrophic. All files are encrypted, their extensions are changed (often appending the attacker's email address and a specific extension like `.crusis`, `.dharma`, or `.wallet`), and a ransom note (`FILES ENCRYPTED.txt`) is dropped on the desktop. For incident responders, Crusis signifies a severe perimeter breach. The attackers have likely been inside the network for days, elevating privileges, disabling backups, and exfiltrating data before manually executing the encryption payload.

Execution and Human-Operated Tactics
Crusis actors primarily gain initial access by brute-forcing or purchasing compromised RDP credentials (`T1133`). Once inside, they use legitimate administrative tools (living-off-the-land) and credential dumpers (like Mimikatz) to escalate privileges to Domain Admin. They disable antivirus services using tools like `Process Hacker` or uninstaller utilities (`T1562.001`). They aggressively target and delete Volume Shadow Copies (`vssadmin.exe Delete Shadows /All /Quiet`) and backup catalogs (`T1490`). Finally, the Crusis executable is pushed across the network via GPO or PsExec, encrypting files using strong AES/RSA cryptography (`T1486`).

Indicators of Compromise & Impact
The impact is a total halt of business operations and potential data extortion. EDR platforms must alert on anomalous RDP logins (especially off-hours or from foreign IPs), the execution of `vssadmin.exe`, and the mass renaming of files. The presence of the dropped executable (often named `payload.exe` or simply a random string) in the `%AppData%` or `%Temp%` directory is a key IoC.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1059: Restrict execution of scripting languages such as PowerShell, VBScript, or Python to authorized administrators. Enforce Script Block Logging.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_CRUSIS {
    meta:
        description = "Detects Crusis (ransomware)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "crusis" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Crusis Activity
id: dcf22adc5e523af0e120304456d5ca4a
status: experimental
description: Detects generic indicators of the crusis malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*crusis*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Instantly sever the infected endpoint and any associated servers from the network to halt the lateral spread of the encryption process.
2. Identify and immediately disable the compromised RDP accounts or VPN profiles that the attackers used for initial access.
3. Do NOT reboot the infected machines, as the encryption keys may still reside in volatile memory (RAM), which is critical for potential forensic recovery.
4. Check for and sever any active C2 connections or unauthorized remote access tools (like AnyDesk or TeamViewer) dropped by the attackers for persistence.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not pay the ransom immediately; engage professional incident response and negotiation firms, as paying does not guarantee a decryptor and funds criminal enterprises.
2. Avoid wiping the machines until forensic images have been captured; crucial evidence regarding data exfiltration is stored in the system logs.

References & External Analysis

• Search "crusis" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: ransomware)

Explore other malware families in the same category:

• Estrella
• Binderon
• Hallaj
• Admoke
• Psloader

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/crusis.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.