KageNoHitobito Ransomware Technical Analysis

KageNoHitobito is a ransomware family whose samples became publicly available in late March 2024. It encrypts files on the local drives of infected machines, marks them with a .hitobito extension and demands a ransom for the decryption keys. It talks to victims over the TOR network, evades debuggers and stays active after reboot through a registry key.

This blog post comes from the KageNoHitobito Ransomware Technical Analysis report. If you want to read more details, download it as a PDFclick here

What is the KageNoHitobito ransomware?

In late March 2024, samples of the KageNoHitobito ransomware became publicly available. This ransomware operates by encrypting files on infected machines and then demanding a ransom in exchange for the decryption keys, as indicated in ransom notes left on the victims’ systems. The KageNoHitobito group utilizes the TOR network to facilitate communication with its victims but does not maintain a data leak site, indicating that they do not claim to have exfiltrated any sensitive information from the victims.

Additionally, the KageNoHitobito ransomware employs sophisticated techniques to evade detection, including debugger evasion tactics to avoid analysis by security researchers. For persistence, it modifies the system registry to ensure it remains active even after the system is rebooted. Notably, the ransomware is designed to target and encrypt files solely on the local drives of compromised computers, avoiding any networked drives. The files encrypted by this ransomware are identifiable by a distinctive “.hitobito” extension.

Scope

MITRE ATTA&CK Threat Matrix

1. TA0002 Execution
   • T1059 Command and Scripting Interpreter
   • T1106 Native API
2. TA0003 Persistence
   • T1547 Boot or Logon Autostart Execution
     • T1547.001 Registry Run Keys / Startup Folder
3. TA0005 Defense Evasion
   • T1027 Obfuscated Files or Information
   • T1036 Masquerading
   • T1070 Indicator Removal
   • T1622 Debugger Evasion
   • T1070.006 Time Stomp
   • T1112 Modify Registry
   • T1140 Deobfuscate/Decode Files or Information
4. TA0007 Discovery
   • T1057 Process Discovery
   • T1082 System Information Discovery
   • T1083 File and Directory Discovery
5. TA0040 Impact
   • T1486 Data Encrypted for Impact

How can you defend against KageNoHitobito?

Regularly check for the presence of suspicious keys in the Windows registry, specifically under the path Software\Microsoft\Windows\CurrentVersion\Run. Be alert for a key named AlertaRansomware, which indicates the presence of the KageNoHitobito ransomware.

Maintain regular and up-to-date backups of all critical data. Ensure these backups are stored offline and are not accessible from the network.

Conclusion

This report provides a detailed technical analysis of the KageNoHitobito ransomware. The malware contains a number of sophisticated capabilities. KageNoHitobito is notable for its ability to employ advanced detection evasion techniques, including debugger evasion, to avoid analysis by security researchers. It also achieves persistence on infected systems through registry modifications, specifically by creating a key.

Our analysis has comprehensively examined the code structure and behavioral characteristics of the KageNoHitobito ransomware, providing key insights into its propagation methods. This information can help organizations formulate more effective protection strategies. Of particular note are the malware’s stealth techniques, which highlight the need for improvements to alert systems to increase their sensitivity.

You can find the IoCs and YARA Rules on our GitHub Repo.

This blog post comes from the KageNoHitobito Ransomware Technical Analysis report. If you want to read more details, download it as a PDFclick here