Full Report
Group-IB uncovers a new stealthy ransomware strain
Analysis Summary
# Tool/Technique: Eldritch (or "Stealthy Ransomware strain")
## Overview
Group-IB has uncovered a highly stealthy, cross-platform ransomware strain designed to target both Windows and Linux/ESXi environments. The malware is characterized by its modular architecture, use of side-loading to bypass security software, and an unusual reliance on external configuration files to dictate its behavior.
## Technical Details
- **Type:** Malware family (Ransomware)
- **Platform:** Windows, Linux, VMware ESXi
- **Capabilities:** Lateral movement, service termination, volume shadow copy deletion, multi-threaded encryption, and modular payload execution.
- **First Seen:** Early 2024 (Group-IB discovery)
## MITRE ATT&CK Mapping
- **TA0005 - Defense Evasion**
- T1574.002 - Hijack Execution Flow: DLL Side-Loading
- **TA0007 - Discovery**
- T1082 - System Information Discovery
- **TA0009 - Collection**
- T1005 - Data from Local System
- **TA0040 - Impact**
- T1486 - Data Encrypted for Impact
- T1489 - Service Stop
- T1490 - Inhibit System Recovery
## Functionality
### Core Capabilities
- **Cross-Platform Compatibility:** Compiled versions exist for both Windows (PE) and Linux/ESXi (ELF) environments.
- **Service Termination:** Automatically stops security, backup, and database-related services to ensure files are not locked and recovery is hindered.
- **System Recovery Inhibition:** Uses `vssadmin`, `bcdedit`, and `wbadmin` to delete shadow copies and backup states.
- **Config-Driven Execution:** Relies on a `config.ini` file to specify encryption parameters, excluded directories, and targeted services.
### Advanced Features
- **DLL Side-Loading:** On Windows, the ransomware uses a legitimate signed executable (`cy.exe`) to side-load a malicious DLL (`winutils.dll`), which then decrypts and executes the core ransomware payload in memory to evade EDR/AV.
- **Modular Payload:** The payload is often "dumped" or injected, making static analysis difficult as the primary executable appears benign.
- **ESXi Targeting:** Specific modules designed to shut down Virtual Machines (VMs) before encrypting their virtual disks (.vmdk files).
## Indicators of Compromise
- **File Hashes (SHA256):**
- `4874d336c5c7c2f558cfd5954655cacfc85bcfcb512a45fb0ff461ce9c38b86d` (cy.exe)
- `2fd264f58ba82a2675280ec8c6759612def2bcc62aa6160f5e23071f67bb67ab` (winutils.dll)
- `03c41019faf7e4cc26ca0dd3a2c41b2115e4c4ebd561402079bc4a20256c1813` (config.ini)
- `7d62a33e9a2fedff6cf27aaa142ff15838a766ccd4a8d326424611e155442775` (Linux/ESXi variant)
- **File Names:** `cy.exe`, `winutils.dll`, `config.ini`, `Shortcut.exe`, `libexpa.dll`
- **Network Indicators:** (Emails defanged)
- `[email protected][.]com`
- `[email protected][.]com`
- **Behavioral Indicators:** Execution of `vssadmin.exe delete shadows /all /quiet` and `bcdedit /set {default} recoveryenabled No`.
## Associated Threat Actors
- Currently attributed to an emerging, financially motivated group; specific naming conventions are pending further intelligence.
## Detection Methods
- **Signature-based:** Monitoring for the specific SHA256 hashes of the side-loading components.
- **Behavioral detection:** Flagging unauthorized use of `vssadmin` or `bcdedit` combined with high-volume file rename/write operations.
- **YARA:** Scans targeting the specific decryption routine used in `winutils.dll` to unpack the ransomware payload.
## Mitigation Strategies
- **Endpoint Protection:** Enable advanced heuristic analysis and behavior monitoring to detect DLL side-loading patterns.
- **Backup Hardening:** Maintain offline, immutable backups that are not accessible via standard domain credentials.
- **Privilege Management:** Restrict administrative tools like `vssadmin` and `bcdedit` to authorized users only.
- **Vulnerability Management:** Ensure ESXi hosts are patched against known remote code execution vulnerabilities often used for initial access.
## Related Tools/Techniques
- **LockBit/BlackBasta:** Similar tactics regarding ESXi targeting and service termination.
- **DLL Side-Loading:** A technique commonly used by APT groups (e.g., Lazarus, Mustang Panda) now frequently adopted by ransomware affiliates.