Technical Analysis of Crytox Ransomware

This report provides a technical analysis of the Crytox ransomware (active since 2020), describing its multi-stage infection chain, use of embedded uTox for victim communication, AES-CBC file encryption with per-file 256-bit keys protected by a locally generated RSA key, persistence mechanisms, and observable Indicators of Compromise (hashes, dropped ReadMe.hta, .waiting extension, and registry keys). It highlights a practical weakness in Crytox's pseudo-random AES key generation (seeded by GetTickCount) that enables known-plaintext brute-force recovery of keys for some file types.