Hunters International ransomware is a Ransomware as a Service (RaaS) operation that is believed to have first appeared in October 2023. The sample in this analysis is written in Rust. It encrypts files with random AES keys protected by an RSA public key, adds the .locked extension, and drops a Contact Us.txt note for victims.
Hunters International ransomware is believed to have first been discovered in October 2023 and operates using a Ransomware as a Service (RaaS) model. It is thought to share similarities with the Hive ransomware in the past. The sample provided for technical analysis is written in Rust.
The ransomware utilizes sophisticated techniques, including execution via command-line arguments and ongoing operations based on disk, system, service, and process controls. It generates random AES keys and subsequently encrypts them with an RSA public key. After encrypting the files, it appends the “.locked” extension to the affected files. Additionally, it creates a “Contact Us.txt” file containing credentials that allow the threat actor to communicate effectively with the victims.
What You Will Find In This Report?
Learn Technical Method of Operation Details
You will find the technical details of the Hunters International, its functions, and details about cyber attack tactics. The report will show many points about its technical details, detections, and IoCs.
Gain Knowledge About Future Attacks
By understanding its attack model, you can make more informed predictions about the future of cybersecurity. Stay up-to-date with the latest trends and keep your business from potential threats.
Response & Mitigation Tactics From Experts
Brandefense analysts share practical response and mitigation advice on this topic. The Hunters employs sophisticated techniques to avoid analysis by security researchers. You need experts’ perspective.
What Does the Hunters International Report Cover?
The report is a 22 page technical analysis of one Hunters International sample. It is dated 05.09.2024 and carries report number BD2024090501. Its chapters are an executive summary, scope, technical analysis, a YARA rule, a MITRE ATT&CK matrix, mitigation strategies, a conclusion and indicators of compromise.
Sample Details
The scope table lists the sample as a PE64 file written in Rust. It gives MD5, SHA1 and SHA256 hashes and a first seen date of 2024-04-26. The initial infection vector is listed as N/A.
Key Technical Findings
- Start up: the ransomware checks for the command line argument “-c username:password”. The report says the victim needs these credentials, which appear in the “Contact US.txt” file.
- Before encryption: it finds drives with GetDriveTypeW and GetLogicalDriveStrings. It runs commands such as wmic.exe shadowcopy delete and wbadmin.exe delete catalog -quiet. It enables privileges such as SeDebugPrivilege and ends a list of processes and services, including mssql, oracle and backup.
- Encryption: worker threads named “tokio-runtime-worker” do the work. The report says 16 random bytes are generated with the BcryptGenRandom API and used to make the AES key. It also lists file names, folders and extensions that are skipped, such as Windows, Program Files, exe, dll and sys.
- After encryption: the MoveFileEx API adds the .locked extension. Contact Us.txt holds the TOR URL of the data leak site. A buffer.swp file is then filled with random bytes until the disk is full.
Detection and Defense in the Report
The report includes a YARA rule named MAL_Hunters_International_Ransomware_x64_Sep05. Its ATT&CK matrix lists techniques such as T1486 Data Encrypted for Impact, T1490 Inhibit System Recovery, T1489 Service Stop and T1134.001 Token Impersonation/Theft.
The mitigation chapter suggests four checks: look for buffer.swp in directories, monitor running processes, look for Contact Us.txt, and look for files with the .locked extension.