Ransomware on Steroids: Cryptowall 2.0
Summary: Cisco Talos analyzed Cryptowall 2.0, a ransomware variant whose dropper uses multiple exploits for initial access, anti-VM and anti-emulation checks to evade sandboxes, and multiple encryption layers, and which can execute 64-bit code directly from its 32-bit dropper by switching the processor execution context under WOW64. Once installed, it adds auto-start registry values, copies a random executable to the Start Menu Startup folder, disables system protections, injects into a faked Svchost process, and downloads a TOR client for command-and-control communication.
Why it matters: The sample's 32-bit-to-64-bit context switch is difficult enough that it hampers IDA disassembly, so sandboxes and static tooling that assume a single execution mode may miss the payload entirely.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026