Settra Ransomware Binary Named [domain]_win64.exe

Ibrahim Saud@tektrix

•updated Sep 18, 2026•0•0•2

Detects Settra ransomware binaries characterized by naming conventions including '_win64.exe', which create 'RESTORE_FILES.txt' ransom notes and use '.locked' or '.locked_wip' file extensions for encrypted data.