Sage 2.2
- First seen
- 2017-02-01 00:00:00
- Malware type
- ransomware
- Profile updated
- 2026-07-07 13:39:36
Context
Ransomware Sage 2.2 deletes volume snapshots through vssadmin.exe, disables startup repair, uses process wscript.exe to execute a VBScript, and coordinates the execution of scheduled tasks via schtasks.exe.
Reports & references
- malwarebreakdown.com — Sage 2 2 Ransomware From Good Man Gate (report)
- malwarebreakdown.com — Finding A Good Man (report)