MAL Crypto24 Keylogger Persistence v1

Aaron Mog@AaronMogS2S

•updated Aug 17, 2025•1•1•20

Detects the keylogger component (WinMainSvc.dll) used by the Crypto24 ransomware group for persistence via Windows Services.