{
  "family": "genasom",
  "sample_count": 17,
  "category": "ransomware",
  "description": "Genasom (classified in antimalware telemetry under signatures including Ransom:Win32/Genasom, Trojan-Ransom.Win32.Genasom, and Win32/Genasom) is a destructive screen-locking and crypto-ransomware family designed to extort computer users through alarming fake legal warnings. Distributed via malicious torrent downloads, compromised adult sites, and drive-by download stagers, Genasom renders a full-screen, non-dismissible lockdown interface that covers the desktop. It claims that the victim's device was flagged by national law enforcement agencies (such as the FBI, DOJ, or local police) for illicit internet activity. Genasom disables access to Task Manager (DisableTaskMgr), hooks keyboard task switching (Alt+Tab, Windows key), and terminates Explorer.exe. Concurrently, it encrypts user documents in the background using AES-256 and demands payment via prepaid money cards or cryptocurrency vouchers.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Ransom:Win32/Genasom",
    "Trojan-Ransom.Win32.Genasom",
    "Win32/Genasom",
    "Ransom.Genasom",
    "Genasom Police Locker"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Ransom:Win32/Genasom?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Genasom is a screen-locking and crypto-ransomware family that locks the Windows interface with fake police warnings to extort money."
      }
    },
    {
      "@type": "Question",
      "name": "How does Genasom lock user access to the computer?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It terminates explorer.exe, creates a topmost borderless window, disables Task Manager, and blocks keyboard shortcuts."
      }
    },
    {
      "@type": "Question",
      "name": "Are the legal allegations displayed by Genasom genuine?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "No, the legal warnings claiming FBI or police violations are completely fraudulent and generated by cybercriminals."
      }
    },
    {
      "@type": "Question",
      "name": "How is Genasom delivered to victim machines?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It spreads via drive-by downloads, compromised adult streaming sites, and Trojanized media player codecs."
      }
    },
    {
      "@type": "Question",
      "name": "How can a system infected by Genasom be unlocked?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Boot the computer into Windows Safe Mode with Command Prompt, delete the locker executable, and restore system policies via registry."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1486",
    "T1490",
    "T1491.001",
    "T1112",
    "T1083"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2013,
  "threat_actor": null,
  "delivery_mechanism": [
    "Drive-by Downloads on Compromised Websites",
    "Malicious Media Codec Installers",
    "Deceptive Torrent Downloads"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Full-Screen Non-Dismissible Screen Lockdown",
    "Task Manager Disablement (DisableTaskMgr)",
    "Keyboard Shortcut Hooking (Alt+Tab, Ctrl+Alt+Del)",
    "Background Symmetric File Encryption (AES-256)",
    "Autostart Winlogon Shell Hijacking"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable"
    ],
    "network_signatures": [
      "Outbound HTTP requests retrieving geolocation-specific police logos and ransom text",
      "Beacon traffic reporting machine GUID and lock confirmation"
    ],
    "evasion_techniques": [
      "Setting the topmost window style (WS_EX_TOPMOST) and disabling desktop shell components",
      "Writing policy values under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "0718293a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e",
      "18293a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableTaskMgr",
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\GenasomLock"
    ],
    "file_paths": [
      "%AppData%\\Genasom\\locker.exe",
      "C:\\GENASOM_NOTE.txt"
    ]
  },
  "defensive_measures": [
    "Deploy endpoint security software capable of detecting screen locking and shell modification behavior",
    "Maintain verified offline backups to recover encrypted personal files without paying extortionists",
    "Configure group policies preventing non-administrative execution from user AppData directories"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Ransom:Win32/Genasom",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Genasom"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Ransom.Win32.Genasom",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [
      "Ransom:Win32/Winlock",
      "Ransom:Win32/Reveton"
    ],
    "variants": [
      "Ransom:Win32/Genasom.A",
      "Ransom:Win32/Genasom.B"
    ]
  },
  "attack_stage": [
    "initial_access",
    "execution",
    "persistence",
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "motivation": "Police Scareware Extortion & Ransom Demands",
  "sample_hashes": []
}