Ransomware.YggGuru - Go ransomware targeting Documents

sample source

theZoo

type

Ransomware

family

Ransomware.YggGuru

platform

Windows

architecture

x86-64

bitness

64-bit

format

PE32+

written in

Go

packer

UPX

tools

Detect It Easy, IDA Pro, Ghidra

approach

static only, binary never executed

date

2026-09-21

The sample

The file is a 64-bit Windows executable (PE32+) named update.exe.

• MD5: b61d829b6b1fc2ecc12a86db5d99d826
• SHA-1: 2485276a4bed442d34f2b10ea0181c5152f95616
• SHA-256: c3b71a279800e79535b096b110c9cf27ff16b92cf0a18200dd777a9abae9a5e7
• IMPHASH: 6ed4f5f04d62b18d96b26d6db7c18840

Detect It Easy identified the file as packed with UPX 5.11 using LZMA compression. The overall entropy of the packed binary was 7.99.

Triage and unpacking

I unpacked the file using upx -d, which produced update_unpacked.exe.

The overall entropy dropped to 6.27, but Detect It Easy still showed a local peak reaching 8.0 around offset 0x5759b0.

I got curious about the peak. It turned out to be Go's runtime symbol table (pclntab).

Strings and threat intelligence

Running strings produced a large text dump dominated by Go runtime internals, time zone names, and TLS error strings. Filtering through the noise revealed the ransomware artifacts:

• Ransom note header: ALL YOUR FILES HAVE BEEN ENCRYPTED
• Ransom note filename: README_RESTORE.txt
• Bitcoin address: bc1q9x4m27d3kge0f8v5td0w4rjhkfz5a5nqpfsghr
• Contact email: noreply@ygg.guru
• C2 endpoint: https://ygg.guru/api/health
• Encryption algorithm: AES-256-GCM
• Target extension: .locked
• Targeted processes: excel.exe, msword.exe, mysqld.exe, postgres.exe, outlook.exe
• Backup commands: vssadmin, shadowcopy, wbadmin, catalog, bcdedit
• Registry keys: HKCU\Software\Microsoft\Windows\CurrentVersion\Run and HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System

The MD5 hash matched an AlienVault OTX pulse named Ransomware.YggGuru - Go-based ransomware with C2 exf.... VirusTotal showed 52 detections out of 71 engines. The binary also contained source path references to /Users/anthony/poc-cyber/cmd/ransomware/main.go.

README_RESTORE.txt
bc1q9x4m27d3kge0f8v5td0w4rjhkfz5a5nqpfsghr
noreply@ygg.guru
https://ygg.guru/api/health

Imports and dynamic loading

The import table lists only KERNEL32.dll.

Among the entries:

• CreateThread, ResumeThread, SuspendThread
• VirtualAlloc, VirtualFree, VirtualQuery
• CreateIoCompletionPort, GetQueuedCompletionStatusEx

There are no static imports for cryptography, networking, or the Windows registry. Go loads the other DLLs dynamically via LoadLibraryExW and GetProcAddress.

KERNEL32.dll
    LoadLibraryExW
    GetProcAddress
    VirtualAlloc
    CreateThread
    CreateIoCompletionPort

Execution flow in main.main

I opened the unpacked binary in IDA Pro and decompiled main_main using Hex-Rays.

The function executes the following sequence:

• main_killProcesses terminates targeted processes to release file locks.
• main_deleteShadowCopies calls vssadmin, wbadmin, and bcdedit to inhibit recovery.
• main_addPersistence writes WindowsUpdateService under HKCU\Software\Microsoft\Windows\CurrentVersion\Run.
• main_disableTaskManager sets DisableTaskMgr in registry policies.
• main_enumerateDrives and main_getTargetDir set the target folder to %USERPROFILE%\Documents.
• poc_cyber_internal_pocrypto_GenerateKey generates a 32-byte key.
• A loop calls main_encryptFile on each target file using AES-256-GCM and counts successful encryptions.
• main_exfiltrateKey sends the machine ID, the key, and the file count to https://ygg.guru/api/health.
• main_dropRansomNote creates README_RESTORE.txt with the count of affected files.
• main_setWallpaper sets wall.bmp.
• runtime_memclrNoHeapPointers zeroes out the key in memory.

v0 = main_killProcesses();
v1 = main_deleteShadowCopies(v0);
main_addPersistence(v1);
r0 = main_disableTaskManager()._r0;
v32 = main_enumerateDrives(r0);
TargetDir = main_getTargetDir();
// ...
TargetFiles = main_getTargetFiles(TargetDir._r0, TargetDir._r1);
Key = poc_cyber_internal_pocrypto_GenerateKey(...);
// ...
while ( 1 ) {
  v33 = main_encryptFile(*v2, v2[1], v17, r1, r2);
  // increment encrypted file count
}
main_exfiltrateKey(r3, r4, TargetDir._r0, TargetDir._r1, ..., v25, ...);
v15 = main_dropRansomNote(TargetDir._r0, TargetDir._r1, v25);
main_setWallpaper(v15);
if ( Key._r1 != 0 )
  runtime_memclrNoHeapPointers(Key._r0);

Indicators

• SHA-256: c3b71a279800e79535b096b110c9cf27ff16b92cf0a18200dd777a9abae9a5e7
• MD5: b61d829b6b1fc2ecc12a86db5d99d826
• C2 URL: https://ygg.guru/api/health
• Contact email: noreply@ygg.guru
• BTC address: bc1q9x4m27d3kge0f8v5td0w4rjhkfz5a5nqpfsghr
• Ransom note: README_RESTORE.txt
• Wallpaper: wall.bmp
• Extension: .locked
• Persistence key: HKCU\Software\Microsoft\Windows\CurrentVersion\Run (WindowsUpdateService)
• Policy key: HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System (DisableTaskMgr = 1)

Takeaway

This was my first malware analysis and my first time using IDA and Detect It Easy. I read Practical Malware Analysis in parallel.

← all writeups

Written with the help of AI, based on my own analysis and notes.