DetoxCrypto is a 2016 Windows ransomware kit that researchers believed was sold or run as an affiliate program, since builds appeared with different themes, contact addresses and features, including a Pokemon-styled one and one posing as a Malwarebytes tool. Its dropper unpacks a separate encryptor, a desktop background, an audio clip and a themed locker program; the locker covers the screen, plays the audio and shows the demand, and one build also captured a screenshot of the desktop and sent it to the operator. Reports say file names are left unchanged, so the encrypted files carry no added extension and the replaced wallpaper and locker window are the main signs. Disconnect the machine, leave the locked files in place, do not pay; restoring from an offline backup is the dependable route. Crypt0 was built from this kit and has its own page.
Sources: Malwarebytes Labs, Graham Cluley
Decryptor: Decryptor availability has not been recorded. Checked 2026-10-30.
Dealing with an active incident? Our incident response team is available 24/7.
Emergency response: +1 (877) 364-5161