Yurei Ransomware leverages SMB shares and removable drives to Encrypt Files

Yurei Ransomware: Technical Overview and Impact

The Yurei Ransomware targets Windows systems, utilizing advanced file encryption and stealth techniques to enhance its impact while minimizing detection. Encrypted files are marked with the extension .Yurei , and victims receive a ransom note named _README_Yurei.txt with Tor-based contact channels.

CYFIRMA has identified the Yurei Ransomware as a new strain developed in the Go language, circulating in multiple malware repositories. The ransomware stages its payload in temporary directories, disables backups and logs, spreads via SMB shares and removable media, and executes self-cleaning routines to hinder forensic analysis and recovery.

Encryption Method: Uses per-file ChaCha20 keys wrapped with an attacker's ECIES public key. File Handling: Processes files in 2 MiB chunks to avoid high memory usage, then atomically replaces them to reduce recovery chances. Backup and Log Disabling: Uses PowerShell commands to remove Volume Shadow Copies and backup catalogs. Lateral Movement: Employs credential-based techniques for network propagation, including PSCredential objects and CIM sessions. Self-Cleaning Routines: Executes secureDelete, cleanTraces, and wipeMemory to perform multiple overwrite passes and scrub file metadata.

Static analysis of the Go binary shows similarities with the open-source Prince-Ransomware project. Yurei retains function and module names and shares the ChaCha20 + ECIES encryption scheme, file header layout, and recursive drive enumeration logic. It introduces parallel encryption via Go goroutines, improving speed over previous designs. Compile-time metadata suggests links to other ransomware projects, but the origin remains unclear.

Indicator Type Remarks

1263280c916464c2aa755a81b0f947e769c8a735a74a172157257fca340e1cf4 Sha256 3dec9093b6da575c8700a9eb.ps1

4f88d3977a24fb160fc3ba69821287a197ae9b04493d705dc2fe939442ba6461 Sha256 YureiRansomware.exe

hXXp[:]//fewcriet5rhoy66k6c4cyvb2pqrblxtx4mekj3s5l4jjt4t4kn4vheyd[.]onion URL BLOG LINK

hXXp[:]//fewcriet5rhoy66k6c4cyvb2pqrblxtx4mekj3s5l4jjt4t4kn4vheyd[.]onion/chat/777676f8-2313-425f-873a-65c4df8d5def/chat[.]php URL CHAT LINK

Organizations are advised to prioritize endpoint monitoring for unauthorized PowerShell executions, audit SMB share activity, enforce strict USB device controls, and maintain offline backups to counter this sophisticated ransomware threat.

Based on reporting by GBHackers.