Ransomware Research
Moisha Ransomware
Moisha is a malicious ransomware strain that encrypts victim files and demands ransom payment for decryption. First observed in the wild on August 1, 2022, this ransomware has been actively targeting systems worldwide. Security researchers also track this malware under the aliases: PT_MOISHA Hacking Team, Moisha Doxware.
Quick Facts
- Ransomware Family
- Moisha
- First Seen
- August 1, 2022
- Known Aliases
- PT_MOISHA Hacking TeamMoisha Doxware
How Moisha Ransomware Works
Targeted Files
https://www.joesandbox.com/analysis/690761/0/html https://app.any.run/tasks/09bf449b-2f9d-4bec-8d38-e0ea4dbbe271/
Ransom Note and Payment Demands
After encrypting files, Moisha displays ransom notes demanding payment for file recovery:
!!!READ TO RECOVER YOUR DATA!!!.txtRansom message:
notes/!!!READ TO RECOVER YOUR DATA!!!.txt
Note locations:
EveryFolderTechnical Indicators
Associated Executable Files
The following executable files are associated with Moisha ransomware:
Mau 15.exelsassd.exemoisha.binlsassd.bin
Elastio Can Help You
Don't let Moisha ransomware take over your data
Elastio provides advanced ransomware protection and recovery solutions to keep your organization safe.
About This Analysis
This Moisha ransomware analysis is part of Elastio's comprehensive ransomware detection database. Elastio provides advanced ransomware protection and recovery solutions, helping organizations defend against and recover from ransomware attacks like Moisha.
Last updated: July 30, 2025