IronChain Ransomware Threatens Businesses with Permanent Data Loss and Costly Downtime
New IronChain ransomware build uses kernel drivers and can permanently destroy files even if victims pay.
ANY.RUN analyzed a fresh IronChain sample, SHA-256 09b550d66b7ce269fa577edcac54d6ba3e0f3cb5b660a2921b9372d37d52e254, a 9.7 MB unsigned 64-bit PyInstaller executable compiled on 12 September 2026. Unpacking recovered IronChain.pyc, hundreds of Python modules, and four Windows kernel drivers. The intended chain seeks administrator rights, creates a SYSTEM scheduled task, impairs defenses and recovery, encrypts files, attempts raw disk damage, and spreads through shares and removable media. Researchers say coding errors can block some steps, but working components can still destroy data with no reliable recovery even if a ransom is paid. Public IronChain samples date to February 2026.
- September 2026 sample is a 9.7 MB unsigned PyInstaller Windows executable.
- Payload includes four kernel drivers and an IronChain_SYSTEM scheduled task.
- Encryption and disk-damage logic can cause permanent loss even after payment.
- Sandbox showed firewall-disable attempts and EventLog and Resmon suppression.
- The intended chain also spreads through shares and removable media.
- ATT&CK
- T1486 Data Encrypted for ImpactT1561.001 Disk Content WipeT1490 Inhibit System RecoveryT1053.005 Scheduled TaskT1562.001 Disable or Modify Tools
- Vendors
- Microsoft
- Products
- WindowsPyInstaller
- Malware
- IronChain
- Organizations
- ANY.RUN
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 103.224.182.251 | ic session also associated repeated no-response requests to 103.224.182.251 with the sample. The direct-IP requests received no respons |
| ipv4 | 3.1.0.29 | C, 4-byte PID Wrong IOCTL and too short Lenovo LnvMSRIO.sys 3.1.0.29, stored as BootRepair.sys \\.\BootRepair, 0x00222014, 4-byt |
| md5 | 2ac6ca0dd3cc83f5a12d12742d539fc9 | b7ce269fa577edcac54d6ba3e0f3cb5b660a2921b9372d37d52e254 MD5 2ac6ca0dd3cc83f5a12d12742d539fc9 Size 9,699,466 bytes Format PE32+ x64, PyInstaller PE times |
| sha256 | 09b550d66b7ce269fa577edcac54d6ba3e0f3cb5b660a2921b9372d37d52e254 | change which actions can run. Sample property Value SHA-256 09b550d66b7ce269fa577edcac54d6ba3e0f3cb5b660a2921b9372d37d52e254 MD5 2ac6ca0dd3cc83f5a12d12742d539fc9 Size 9,699,466 bytes F |
From the original article
12 min read at any.run
Editor’s note: This research was conducted by Himanshu Anand, an independent cybersecurity researcher (follow Himanshu on X). During Cybersecurity Awareness Month, ransomware remains one of the clearest examples of how a cyber incident can become a business continuity issue. IronChain shows why.
By Himanshu Anand · any.run
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.