LCRYX Ransomware VBScript Payload Download via MSXML2.ServerXMLHTTP to C2 URLs

Ibrahim Saud@tektrix

•updated Jun 25, 2026•12•0•3

Detects LCRYX ransomware components executing via wscript.exe or cscript.exe to download secondary malicious payloads using MSXML2.ServerXMLHTTP and ADODB.Stream, targeting the C:\Windows\ directory. The rule matches on specific C2 domains/IP addresses and known file drop paths associated with multi-stage malware infections.