Amnesia
Overview
Executive Summary
Amnesia refers to two distinct but significant malware threats: a destructive Ransomware variant targeting Windows systems, and a more recent IoT (Internet of Things) Botnet targeting embedded Linux devices. Both iterations are designed for extortion or severe disruption, leveraging compromised systems for financial gain or to launch massive Distributed Denial of Service (DDoS) attacks.Infection Vector and Technical Capabilities
Amnesia Ransomware (Windows): Typically distributed via malicious email attachments or RDP brute-forcing. Once executed, it rapidly encrypts user files using strong encryption algorithms (e.g., AES + RSA), appending specific extensions (like `.amnesia`) to the encrypted files, and demands payment in cryptocurrency for the decryption key. Amnesia IoT Botnet (Linux/Embedded): This variant propagates by scanning the internet for exposed IoT devices (like DVRs, IP cameras, or routers) and exploiting known remote code execution (RCE) vulnerabilities (such as the TVT DVR RCE exploit).- Virtual Machine Evasion: A defining characteristic of the IoT variant is its aggressive anti-analysis capabilities. It actively attempts to detect if it is running in a virtual machine (like QEMU) used by security researchers. If detected, it attempts to permanently brick the virtual machine by deleting all files in the file system.
- DDoS Capabilities: Once successfully installed on an IoT device, the bot connects to a C2 server and awaits commands to participate in massive, volumetric DDoS attacks against target networks.
Threat Assessment
The ransomware variant poses a direct threat to business continuity, potentially causing irreversible data loss and significant financial impact. The IoT variant poses a broader threat to network stability, as compromised internal devices can be weaponized to participate in external attacks, leading to IP blacklisting and bandwidth exhaustion.Incident Response and Remediation
- For Windows Ransomware: Immediately isolate the infected host to prevent the ransomware from encrypting mapped network drives. Do not pay the ransom. Restore systems from offline, immutable backups.
- For IoT Botnet: Identify the compromised embedded devices on the network. Isolate them from the internet immediately. The most effective remediation is a factory reset of the device, followed immediately by applying the latest firmware patch from the manufacturer and changing all default credentials.
- Network Hardening: Ensure IoT devices are placed on a segregated VLAN with no direct inbound internet access to prevent exploitation.
Known aliases
Threat reports may refer to this family under multiple names:
MITRE ATT&CK Techniques
This family has been observed using the following ATT&CK techniques: T1486 T1498 T1497.001 T1190
Generated Detections (Boilerplate)
These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.
YARA Rule
rule MALWARE_WIN_AMNESIA {
meta:
description = "Detects Amnesia (ransomware)"
author = "SystemHelpdesk Boilerplate Generator"
date = "2026-07-06"
strings:
$s1 = "amnesia" ascii wide nocase
$s2 = "ransomware.amnesia" ascii wide nocase
$s3 = "linux.amnesia" ascii wide nocase
$s4 = "botnet.amnesia" ascii wide nocase
$s5 = "troj/amnesia" ascii wide nocase
condition:
uint16(0) == 0x5a4d and any of them
}Sigma Rule
title: Suspicious Amnesia Activity
id: d4c72e84ffc53ba06c67e1179deb3cfa
status: experimental
description: Detects generic indicators of the amnesia malware family.
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith:
- '\cmd.exe'
- '\powershell.exe'
CommandLine|contains:
- "*amnesia*"
- "*ransomware.amnesia*"
- "*linux.amnesia*"
- "*botnet.amnesia*"
- "*troj/amnesia*"
condition: selection
level: mediumReferences & External Analysis
- Search "amnesia" on VirusTotal (External Analysis)
Frequently Asked Questions
How do I remove the Amnesia Ransomware from Windows?
Manual removal of Amnesia is highly discouraged as it may leave persistence mechanisms intact. We recommend disconnecting the device from the internet and utilizing a professional incident response service or enterprise-grade EDR software to conduct a full forensic sweep.
Is Amnesia a virus or a Ransomware?
Amnesia is classified as a Ransomware. Unlike traditional viruses that infect files, modern malware like Amnesia typically operates as a standalone payload designed to compromise systems, steal data, or deploy secondary stage implants.
What are the main symptoms of a Amnesia infection?
Symptoms of Amnesia can include unexpected system slowness, unauthorized outbound network traffic to unknown IP addresses, disabled security software, and suspicious background processes running from AppData or Temp directories.
Related Families (Category: ransomware)
Explore other malware families in the same category:
Protect Your Network Against Ransomwares
Want to prevent Amnesia and similar threats from compromising your organization? Read our comprehensive defensive guide: Ransomware Protection Guide.
Machine-readable
Get this profile as JSON: https://jordan123234-malware-families-explorer.static.hf.space/api/amnesia.json
Ecosystem & Interactive Environments
This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.