cyber.hendryadrian.com
Threat Research · darkatlas.io

Technical Analysis Details Payload Ransomware’s Encryption and Anti-Forensics

· Original article ↗

Summary

A technical analysis says Payload ransomware uses per-file Curve25519 ECDH-derived ChaCha20 encryption, an RC4-protected file footer, and ETW, VSS and event-log tampering. It reports 50 organizations listed on the group’s leak site by March 24, 2026.

Key points

  • The analysis describes a Windows ransomware sample that encrypts files with ChaCha20 using a fresh per-file Curve25519 ECDH shared secret directly as the key, without a KDF.
  • Encrypted files receive the .payload extension and a 56-byte RC4-encrypted footer; the malware also writes RECOVER_payload.txt notes and recovery data to recovery.ini.
  • The sample uses I/O Completion Ports for parallel encryption and dynamically resolved NT APIs for file operations.
  • Anti-forensics features include patching ETW functions, deleting Volume Shadow Copies, clearing Windows Event Logs, and terminating selected processes and services.
  • The article reports that Payload’s leak site listed 50 organizations by March 24, 2026; this is a claim-monitoring figure, not independent confirmation of those incidents.
  • The analysis includes a YARA rule for identifying the described sample.

Article Details

Attack Vectors
  • Payload ransomware encrypts files on Windows with ChaCha20, deriving a separate key for each file through Curve25519 ECDH.
  • The ransomware can enumerate drives and network shares when its -s network-share mode is used.
  • Before or during encryption, Payload can terminate selected processes and services, patch ETW functions, delete VSS shadow copies, and clear Windows Event Logs.
Defensive Notes
  • The article recommends monitoring Payload’s leak-site activity, victimology, infrastructure, and future code changes.
  • The sample’s reported behaviors include ETW patching, VSS deletion, Windows Event Log clearing, and termination of selected processes and services.

Indicators of compromise

TypeIndicatorContext
MD5e0fd8ff6d39e4c11bdaf860c35fd8dc0MD5 hash of the analyzed Payload ransomware sample.
SHA1dde1b933aad33c5d96c2e45ad46434a200dc46a6SHA1 hash of the analyzed Payload ransomware sample.
SHA2561ca67af90400ee6cbbd42175293274a0f5dc05315096cb2e214e4bfe12ffb71fSHA256 hash of the analyzed Payload ransomware sample.

MITRE ATT&CK

T1027 · Obfuscated Files or InformationThe article describes double-base64 encoding of secondary key material as an obfuscation technique.T1059.003 · Windows Command ShellThe ransomware invokes cmd.exe to run vssadmin.exe for shadow-copy deletion.T1070.001 · Clear Windows Event LogsPayload clears Windows Event Log channels, including Application, System, Security, and Setup.T1083 · File and Directory DiscoveryThe ransomware enumerates directories and files to identify files for encryption.T1106 · Native APIThe sample dynamically resolves and uses NT APIs for file operations, directory enumeration, and file renaming.T1135 · Network Share DiscoveryThe article reports drive and network-share enumeration controlled by the ransomware’s -s flag.T1486 · Data Encrypted for ImpactPayload encrypts victim files with ChaCha20 and appends the .payload extension.T1489 · Service StopPayload stops selected services, including the Volume Shadow Copy Service and backup services.T1490 · Inhibit System RecoveryBefore encryption, the ransomware runs vssadmin.exe to delete all VSS shadow copies.T1562.006 · Indicator BlockingWith --bypass-etw enabled, the ransomware patches ETW functions in ntdll to suppress event reporting.

Threat Actors

PayloadThe article identifies Payload as a ransomware group that listed victims on its leak site, including SODIC and A-Sonic Logistics Solutions; it reports 50 listed victims as of 24 March 2026.

Malware

Payload ransomwarePayload ransomware is a Windows locker that encrypts files with ChaCha20, appends the .payload extension, and drops RECOVER_payload.txt notes while using per-file Curve25519 ECDH key exchange.

Products

Microsoft WindowsPayload ransomware is a Windows locker that encrypts files with ChaCha20, appends the .payload extension, and drops RECOVER_payload.txt notes while using per-file Curve25519 ECDH key exchange.

Countries

EgyptPayload ransomware first appeared publicly in February 2026 and quickly showed a global victim footprint across Egypt, Mexico, Poland, and other regions.MexicoPayload ransomware first appeared publicly in February 2026 and quickly showed a global victim footprint across Egypt, Mexico, Poland, and other regions.PolandPayload ransomware first appeared publicly in February 2026 and quickly showed a global victim footprint across Egypt, Mexico, Poland, and other regions.

Industries

Logistics and transportationThe group appears especially active against logistics and transportation, with victims such as A-Sonic Logistics Solutions highlighting interest in organizations tied to supply chains, freight forwarding, andManufacturingPayload’s victimology also includes manufacturing, professional services, technology, and general commercial enterprises.Professional ServicesPayload’s victimology also includes manufacturing, professional services, technology, and general commercial enterprises.Real estate and constructionAnother noticeable segment is real estate and construction, particularly in Egypt and the wider MENA region.TechnologyPayload’s victimology also includes manufacturing, professional services, technology, and general commercial enterprises.

Related Articles