Spora
- First seen
- 2017-01-01 00:00:00
- Malware type
- ransomware
- Family
- Malware family
- Related IoCs
- 5 (1 malicious)
- Last IoC activity
- 2026-10-13 05:52:07
- Profile updated
- 2026-07-07 14:52:07
Targeted industries: financial-services healthcare-and-pharmaceutical retail-and-hospitality
Targeted regions: country_code:ru country_code:us
Context
Spora is a sophisticated ransomware known for encrypting files and offering varied decryption payment options, including partial recovery. It notably does not require an internet connection to function and was first observed in early 2017.
Detection coverage
- 1 YARA rules
Detection rules
- MALPEDIA_Win_Spora_Ransom_Auto (yara-rule)
Reports & references
- malpedia.caad.fkie.fraunhofer.de — Win.Spora Ransom (report)
- github.com — Sporavaccination (report)
- malware-traffic-analysis.net — Index2 (report)
- nakedsecurity.sophos.com — How Spora Ransomware Tries To Fool Antivirus (report)
- blog.malwarebytes.com — Spora Ransomware (report)
- gdatasoftware.com — 29442 Spora Worm And Ransomware (report)
- linkedin.com — Spora Ransomware Understanding Hta Infection Vector Kevin Douglas (report)
- gdatasoftware.com — 31666 Ransomware Identification For The Judicious Analyst (report)