{
  "family": "resod",
  "sample_count": 19,
  "category": "ransomware",
  "description": "Resod (tracked across threat intelligence and antivirus telemetry under signatures including Ransom:Win32/Resod, Trojan-Ransom.Win32.Resod, and Win32/Resod) is a high-impact Windows crypto-ransomware family designed for corporate network extortion. Delivered primarily through brute-forced Remote Desktop Protocol (RDP) sessions, compromised VPN credentials, and malicious software downloaders, Resod targets corporate servers and endpoints to encrypt critical business records. Upon execution, Resod executes administrative shell commands to terminate database, hypervisor, and backup services (such as MSSQL, MySQL, Veeam, and vCenter services) using 'net stop' and 'taskkill', ensuring that databases and virtual disk files can be opened with write access. It systematically destroys system restore points and volume shadow copies using 'vssadmin delete shadows /all /quiet', 'wmic shadowcopy delete', and 'wbadmin delete catalog -quiet'. Resod encrypts targeted user documents, virtual machines, and databases using AES-256 in CBC mode, appending the '.resod' extension to all locked files. It embeds the session key encrypted under an embedded 2048-bit RSA master public key within each file header, and drops ransom notes ('HOW_TO_RESTORE_FILES.txt') directing victims to Tor negotiation portals.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Ransom:Win32/Resod",
    "Trojan-Ransom.Win32.Resod",
    "Win32/Resod",
    "Ransom.Resod",
    "Resod Ransomware"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Ransom:Win32/Resod?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Resod is a corporate-targeting crypto-ransomware that terminates database services and encrypts critical files using AES-256 and RSA-2048."
      }
    },
    {
      "@type": "Question",
      "name": "How does Resod prevent victims from restoring files from shadow copies?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It executes vssadmin and wmic commands to delete all volume shadow copies and system backup catalogs."
      }
    },
    {
      "@type": "Question",
      "name": "How does Resod infect corporate networks?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Attackers deploy Resod through brute-forced RDP connections, compromised VPN credentials, or secondary trojan loaders."
      }
    },
    {
      "@type": "Question",
      "name": "Can files encrypted with the .resod extension be decrypted for free?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "No public decryption tool exists because Resod uses standard AES-256 with keys protected by an asymmetric RSA-2048 public key."
      }
    },
    {
      "@type": "Question",
      "name": "What incident response steps should be taken during a Resod incident?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Isolate all affected network subnets immediately, preserve forensic memory images, block external C2/Tor traffic, and restore data from offline backups."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1486",
    "T1490",
    "T1489",
    "T1083",
    "T1027"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2018,
  "threat_actor": null,
  "delivery_mechanism": [
    "Compromised Remote Desktop Protocol (RDP) Credentials",
    "Spear-phishing Loaders with Weaponized Payloads",
    "Compromised Enterprise VPN Credentials"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019",
    "Windows Server 2016"
  ],
  "capabilities": [
    "Hybrid Cryptography (AES-256-CBC + RSA-2048)",
    "Automated Shadow Copy & Backup Catalog Destruction",
    "Database & Hypervisor Service Termination",
    "Network Share & Mapped Drive Traversal",
    "Ransom Note Generation & Desktop Wallpaper Hijacking"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Win64 PE Executable"
    ],
    "network_signatures": [
      "Outbound connections to Tor proxy gateways or direct Tor bridge addresses",
      "SMB reconnaissance traffic sweeping internal subnets for shared network folders"
    ],
    "evasion_techniques": [
      "Process termination of antivirus and security monitoring agents prior to encryption",
      "Packing with custom PE protectors to evade static signature detection"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f",
      "0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\ResodLocker"
    ],
    "file_paths": [
      "%AppData%\\Resod\\resod.exe",
      "C:\\HOW_TO_RESTORE_FILES.txt"
    ]
  },
  "defensive_measures": [
    "Enforce strict multi-factor authentication on all external-facing RDP and VPN endpoints",
    "Maintain immutable, air-gapped backups that cannot be modified via administrative Windows credentials",
    "Deploy endpoint detection and response (EDR) rules alerting on execution of vssadmin delete shadows"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Ransom:Win32/Resod",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Resod"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Ransom.Win32.Resod",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Ransom:Win32/Resod.A",
      "Ransom:Win32/Resod.B"
    ]
  },
  "attack_stage": [
    "initial_access",
    "execution",
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "motivation": "Financial Extortion & Corporate Ransom Demands",
  "sample_hashes": []
}