VILE Ransomware Decryptor Shortcut and Icon Drop via PowerShell

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•0

Detects execution of PowerShell commands using WScript.Shell to create shortcuts, specifically looking for indicators related to 'vile_Decryptor.lnk' or 'vile_icon.ico'. This pattern is frequently observed in malware deployment or dropper activities aiming to establish persistence or facilitate user-driven execution.