LIUSHEN Ransomware Wallpaper BMP Dropped to Temp Directory

Subhankar H@Andrewsec57

•updated Jul 8, 2026•1•0•3

Detects the creation of BMP files within the Temp directory containing the pattern 'wallpaper_', which is a behavior consistent with LIUSHEN ransomware modifying the desktop background to display a ransom note.