{
  "family": "imali",
  "sample_count": 18,
  "category": "ransomware",
  "description": "Imali (tracked across antimalware signatures as Ransom:Win32/Imali, Trojan-Ransom.Win32.Imali, and Ransom.Imali) is a targeted Windows crypto-ransomware family designed for rapid local storage and network share encryption. Delivered via exploit kits, malicious software repacks, and brute-forced RDP accounts, Imali halts essential Windows database and backup services, deletes volume shadow copies with 'vssadmin delete shadows /all /quiet', and suppresses automatic recovery prompts via bcdedit. Imali encrypts target files using AES-256 in CBC mode, appending the '.imali' extension to encrypted files. It stores the encrypted session keys in each file header using an embedded RSA-2048 master public key, and generates ransom demand notes ('README_RESTORE_IMALI.txt') instructing victims to contact the threat operators.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Ransom:Win32/Imali",
    "Trojan-Ransom.Win32.Imali",
    "Win32/Imali",
    "Ransom.Imali",
    "Imali Ransomware"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Ransom:Win32/Imali?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Imali is a targeted Windows crypto-ransomware family that encrypts files and network shares using AES-256 and RSA-2048."
      }
    },
    {
      "@type": "Question",
      "name": "How does Imali prevent shadow copy recovery?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It runs vssadmin delete shadows commands to erase volume shadow copies before starting encryption."
      }
    },
    {
      "@type": "Question",
      "name": "How is Imali delivered to victim systems?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is delivered through malicious software downloads, exploit kits, and compromised remote access credentials."
      }
    },
    {
      "@type": "Question",
      "name": "Can files with the .imali extension be decrypted without paying?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "No public decryption tool exists because Imali uses industry-standard AES-256 with asymmetric RSA key wrapping."
      }
    },
    {
      "@type": "Question",
      "name": "What defensive measures protect against Imali ransomware?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Enforce multi-factor authentication on remote access, maintain isolated backups, and monitor endpoints for shadow copy deletion."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1486",
    "T1490",
    "T1489",
    "T1083",
    "T1027"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2018,
  "threat_actor": null,
  "delivery_mechanism": [
    "Phishing Emails with Obfuscated Loaders",
    "Compromised Remote Desktop Protocol (RDP)",
    "Trojanized Software Installers"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7",
    "Windows Server"
  ],
  "capabilities": [
    "Hybrid File Encryption (AES-256-CBC + RSA-2048)",
    "Automated Shadow Copy & Boot Recovery Deletion",
    "Database & Antivirus Service Termination",
    "Local Hard Drive & Mapped Share Traversal",
    "Automated Ransom Note Drop"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable"
    ],
    "network_signatures": [
      "Outbound connections to Tor proxy bridges or anonymous negotiation portals",
      "Internal SMB port scanning traffic detecting network file shares"
    ],
    "evasion_techniques": [
      "Terminating security software processes to prevent behavioral blocking",
      "Dynamic API resolution to hide cryptographic and file traversal functions"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b",
      "1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\ImaliLocker"
    ],
    "file_paths": [
      "%AppData%\\Imali\\imali.exe",
      "C:\\README_RESTORE_IMALI.txt"
    ]
  },
  "defensive_measures": [
    "Maintain immutable, air-gapped backups to ensure full recovery without ransom payments",
    "Block execution of vssadmin by non-administrative users using application control policies",
    "Deploy endpoint detection and response (EDR) rules detecting anomalous bulk file modifications"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Ransom:Win32/Imali",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Imali"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Ransom.Win32.Imali",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Ransom:Win32/Imali.A",
      "Ransom:Win32/Imali.B"
    ]
  },
  "attack_stage": [
    "initial_access",
    "execution",
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "motivation": "Financial Extortion & Corporate Ransom Demands",
  "sample_hashes": []
}