Pay2Key Polyglot Batch/PowerShell Fileless In-Memory Payload via setup.cmd

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•1

Detects Pay2Key ransomware's polyglot technique where a Batch script (e.g., setup.cmd) invokes PowerShell to read its own content and execute it in-memory via Invoke-Expression (IEX). This includes detection of 64-bit PowerShell invocation from 32-bit processes using Sysnative and command-line patterns indicative of self-referencing fileless execution.