Keypoints
- A new ransomware family named Ymir was discovered in an incident response case in Colombia.
- Attackers gained access using PowerShell remote commands and deployed tools such as Process Hacker and Advanced IP Scanner before running Ymir.
- Ymir performs extensive memory operations (malloc, memmove, memcmp, RtlCopyMemory) to load code and evade detection, and uses ChaCha20 to encrypt files with the extension .6C5oy2dVr6.
- The binary contains an embedded ransom note PDF (INCIDENT_REPORT.pdf) in its .data section and writes that PDF into each affected directory.
- Kaspersky authored YARA rules for detection and observed a test sample and related telemetry tying the attack to other malicious components and C2 servers.
- Prior to the ransomware deployment, a RustyStealer infection and SystemBC PowerShell scripts were used to harvest credentials, move laterally via WinRM, and exfiltrate selectively filtered files.
- Kaspersky detects the threat as Trojan-Ransom.Win64.Ymir.gen and warns that initial access broker activity enabled the later ransomware deployment.
MITRE Techniques
- [T1083] File and Directory Discovery – Used to locate files and directories for encryption. Quote: [‘File and Directory Discovery (T1083): Used to locate files and directories for encryption.’]
- [T1082] System Information Discovery – Gathers system and environment information used during execution and anti-analysis checks. Quote: [‘System Information Discovery (T1082): Gathers system information to aid in execution.’]
- [T1059.001] Command and Scripting Interpreter: PowerShell – PowerShell is used for initial remote access, running self-delete commands, and orchestrating actions. Quote: [‘Command and Scripting Interpreter: PowerShell (T1059.001): Executes commands via PowerShell for malicious actions.’]
- [T1486] Data Encrypted for Impact – Encrypts victim files to deny access and extort victims. Quote: [‘Data Encrypted for Impact (T1486): Encrypts files to extort victims.’]
- [T1497.003] Virtualization/Sandbox Evasion: Time Based Evasion – Uses timing and system uptime checks (GetTickCount, QueryPerformanceCounter) to detect debugging or sandbox environments. Quote: [‘Virtualization/Sandbox Evasion: Time Based Evasion (T1497.003): Implements techniques to avoid detection in virtualized environments.’]
- [T1070.004] Indicator Removal on Host: File Deletion – Removes traces by deleting the binary via a PowerShell Remove-Item sequence. Quote: [‘Indicator Removal: File Deletion (T1070.004): Deletes indicators of compromise to cover tracks.’]
- [T1057] Process Discovery – Enumerates running processes to avoid interfering with or being detected by other software. Quote: [‘Process Discovery (T1057): Identifies running processes to avoid detection.’]
- [T1129] Shared Modules – Uses shared modules and standard libraries (e.g., CryptoAPI DLLs, bcrypt) to perform cryptographic operations and runtime loading. Quote: [‘Shared Modules (T1129): Utilizes shared modules for executing malicious code.’]
- [T1027] Obfuscated Files or Information – Employs obfuscation and in-memory unpacking to hinder analysis and to hide strings and payloads. Quote: [‘Obfuscated Files or Information (T1027): Employs obfuscation to hinder analysis and detection.’]
Indicators of Compromise
- [File hashes] Malware and related files – MD5 12acbb05741a218a1c83eaa1cfc2401f, SHA-256 cb88edd192d49db12f444f764c3bdc287703666167a4ca8d533d51f86ba428d8, and other hashes (and 7 more hashes).
- [Filenames] Embedded and deployed artifacts – INCIDENT_REPORT.pdf (ransom note), AudioDriver2.0.exe (RustyStealer drop name).
- [IP addresses] C2 and upload servers – 74.50.84[.]181:443, 94.158.244[.]69:443, 5.255.117[.]134:80 (active upload service), and 85.239.61[.]60 referenced as a C2.
- [URLs/domains] Contact/utility links found in files – hxxps://github[.]com/qTox/qTox/releases/download/v1.17.6/setup-qtox-x86_64-release.exe (qTox client link embedded in the ransom PDF) and other coded endpoints.
- [Registry/configuration] Persistence or user-facing configuration – registry key legalnoticecaption under HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem used to point users to INCIDENT_REPORT.pdf.
Introduction
During an incident response engagement in Colombia, analysts uncovered a previously unseen ransomware family that Kaspersky named Ymir. The sample demonstrated advanced evasive behaviors, notably performing many operations in memory through API calls such as malloc, memmove and memcmp. Attackers initially gained control of the environment with PowerShell remote commands, installed tools including Process Hacker and Advanced IP Scanner to reduce system defenses, and then executed the Ymir binary to carry out the attack.
Analysis
The analysis is divided into static and dynamic inspection of the binary, plus telemetry linking related activity. Static inspection revealed file metadata and embedded strings even though much of the payload unpacks in memory. The sample’s properties include multiple hashes (for example MD5 12acbb05741a218a1c83eaa1cfc2401f and SHA-256 cb88edd192d49db12f444f764c3bdc287703666167a4ca8d533d51f86ba428d8) and strings referencing PowerShell commands, a ransom PDF filename, an encryption extension, and an embedded qTox download link used for victim contact. The binary appears to have been compiled with MinGW on 2024-08-31, matching the creation timestamp embedded in the ransom PDF.
Static analysis
Although entropy did not indicate heavy packing, imports and API calls make clear that the executable allocates memory and loads code at runtime. The binary imports CryptoAPI functions such as CryptAcquireContextA, CryptGenRandom and CryptReleaseContext, as well as process control routines like TerminateProcess and WinExec—APIs typically observed in ransomware. A PDF used as the ransom note is present in the .data section and contains both the victim-facing text and a link to a qTox client the attackers suggest victims use to contact them. String indicators found include the PowerShell self-delete command string ‘powershell -w h -c Start-Sleep -Seconds 5; Remove-Item -Force -Path’, the encryption extension ‘6C5oy2dVr6’, and the ransom filename INCIDENT_REPORT.pdf. Static reverse engineering also showed reuse of CryptoPP-like cryptographic code and a hardcoded list of file extensions to exclude from encryption.
Dynamic analysis
When executed, the sample performs hundreds of memmove calls, loading small instruction fragments into memory that are then executed to perform runtime tasks. The malware gathers system information through calls to GetSystemTimeAsFileTime, GetCurrentProcessId, GetCurrentThreadId, GetTickCount and QueryPerformanceCounter, the latter two used to detect debugging or sandbox conditions. The program also uses RtlCopyMemory from ntdll.dll to load runtime DLLs such as CRYPTSP.dll, rsaenh.dll, bcrypt.dll and kernelbase.dll. For impact, Ymir uses the ChaCha20 stream cipher and appends the extension .6C5oy2dVr6 to encrypted files. It writes the embedded ransom PDF into every directory it processes by copying the PDF data from the .data section and writing it with _write and _fsopen calls. Odd artifacts include a Lingala-language comment observed during execution and behavior that searches the file system for powershell.exe so it can spawn a PowerShell process and run a self-deletion sequence (Start-Sleep then Remove-Item) after a short delay.
YARA rule
Based on the strings, imports and file characteristics uncovered, Kaspersky developed a YARA rule to detect Ymir in real time. The rule looks for combinations of PowerShell self-delete strings, the qTox setup filename, the ransom PDF name, the ChaCha indicator, and imports such as memmove from msvcrt.dll. Using that rule, analysts discovered a related sample that appears to be a test binary submitted from a different geographic origin.
Telemetry
Querying threat intelligence with the YARA rule returned a similar sample first seen originating from Pakistan that behaved as a test build: it accepted a –path parameter to specify a target directory but did not perform encryption or write ransom notes. The test variant also preserved its binary when executed with –path, a deliberate choice that would allow an attacker to reuse the executable across directories. Comparison between the test sample and the fully functional build showed additional strings in the latter such as the appended extension .6C5oy2dVr6 and the full ransom PDF content. At the time of publication, twelve vendors, including Kaspersky, detected the threat.
The ransomware incident
Forensics on the Colombian incident revealed that the Ymir deployment was preceded by a RustyStealer compromise that acted as an access broker. The initial RustyStealer PE was compiled with Rust, deployed as AudioDriver2.0.exe to %windir%temp, and connected to a C2 at 74.50.84[.]181 over port 443. The stealer harvested credentials and system information, enabling the attackers to compromise a domain controller and move laterally using WinRM and PowerShell. The adversary executed PowerShell-based scripts that matched the SystemBC proxy malware family, with script components (for example 1.ps1) that established covert channels to C2 addresses such as 94.158.244[.]69:443 and 5.255.117[.]134:80 and contained functions like GetServerByFilename, SendFile and SearchRoot to select and upload files. The SearchRoot routine uploads files larger than 40 KB and created after a configured date, which suggests selective exfiltration rather than bulk theft by the Ymir binary itself. During the intrusion, the attackers ran Advanced IP Scanner and Process Hacker on multiple hosts and wrote a portion of the ransom-note text into the legalnoticecaption registry value under HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem to prompt users to open INCIDENT_REPORT.pdf.
Conclusion
The evidence shows a clear chain from initial access broker activity and credential harvesting (via RustyStealer) through proxy tooling (SystemBC scripts) to the final deployment of Ymir ransomware. Ymir’s use of in-memory code loading, runtime DLL usage, ChaCha20 encryption and an embedded PDF ransom note demonstrates a configurable, mature toolset that poses a high risk to organizations. The attack illustrates the importance of rapid response to early alerts and the limits of relying solely on endpoint protection, because the initial compromises and lateral movement were detected days before the ransomware execution. Kaspersky products detect this family as Trojan-Ransom.Win64.Ymir.gen, and Kaspersky GERT continues to monitor the group’s activity.
Read more: https://securelist.com/new-ymir-ransomware-found-in-colombia/114493/