{
  "family": "geral",
  "sample_count": 14,
  "category": "ransomware",
  "description": "Geral (classified across antimalware research as Ransom:Win32/Geral, Trojan-Ransom.Win32.Geral, and Win32/Geral) is an aggressive Windows crypto-ransomware family designed to execute high-speed file encryption. Distributed through targeted phishing emails and compromised remote access endpoints, Geral terminates office and productivity applications before encrypting files using AES-256 in CBC mode. It appends .geral to encrypted files and drops ransom notes titled HOW_TO_RESTORE_GERAL.txt instructing victims to establish contact with the extortionists via Tor or encrypted messaging. Geral executes shell commands to purge Volume Shadow Copies, wipe system state backups, and disable automatic Windows startup repair.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Ransom:Win32/Geral",
    "Trojan-Ransom.Win32.Geral",
    "Win32/Geral",
    "Geral Ransomware",
    "Ransom.Geral"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Ransom:Win32/Geral?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Geral is a crypto-ransomware family that encrypts files on Windows workstations and servers using AES-256."
      }
    },
    {
      "@type": "Question",
      "name": "How does Geral prevent handle conflicts during encryption?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It terminates open office productivity, email, and database processes to release file locks."
      }
    },
    {
      "@type": "Question",
      "name": "Does Geral encrypt network shares?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Yes, it traverses mapped drives and SMB shares to encrypt files across connected corporate storage."
      }
    },
    {
      "@type": "Question",
      "name": "How does Geral eliminate Windows shadow copies?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It executes vssadmin delete shadows /all /quiet and disables startup recovery via bcdedit."
      }
    },
    {
      "@type": "Question",
      "name": "What should organizations do when encountering Geral ransomware?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Isolate the compromised network segment immediately, collect memory dumps and sample binaries, and restore data from offline backups."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1486",
    "T1562.001",
    "T1490",
    "T1083",
    "T1135",
    "T1059.003"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint immediately to prevent Geral from downloading and executing its secondary payloads (e.g., ransomware).",
    "Audit the Windows Task Scheduler and Registry Run keys to identify and remove the Geral persistence mechanisms.",
    "Review firewall and proxy logs to identify the C2 domains Geral attempted to contact, and block them enterprise-wide.",
    "Capture a live memory image (RAM dump) to extract the injected Geral modules and identify the secondary payloads."
  ],
  "what_to_avoid": [
    "Do not close an incident simply because the initial Geral dropper was quarantined; always verify if secondary payloads were downloaded.",
    "Avoid relying solely on manual file deletion, as the injected processes will likely just recreate the dropped binaries."
  ],
  "target_industries": [
    "Healthcare",
    "Critical Infrastructure",
    "Enterprise"
  ],
  "motivation": "Financial Extortion",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Ransom:Win32/Geral",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Geral"
    },
    {
      "name": "Sophos Threat Center - Ransom_Geral Analysis",
      "url": "https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Ransom-Geral"
    },
    {
      "name": "MITRE ATT&CK - Data Encrypted for Impact (T1486)",
      "url": "https://attack.mitre.org/techniques/T1486/"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}