Pay2Key setup.cmd Polyglot IEX Self-Read In-Memory Execution

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•0

Detects the Pay2Key ransomware's use of a polyglot setup.cmd script that executes embedded PowerShell code in-memory. The detection focuses on PowerShell being launched with the '-nop' flag and a specific pattern using [io.file]::ReadAllText($env:0) to read and execute the script's own content, a technique characteristic of Pay2Key's fileless execution.