{
  "Event": {
    "analysis": "1",
    "date": "2026-06-17",
    "extends_uuid": "",
    "info": "[Threat Intel] Prinz Eugen ransomware: a deep dive into a new Go-based encryptor",
    "protected": false,
    "publish_timestamp": "1782533506",
    "published": true,
    "threat_level_id": "2",
    "timestamp": "1782533506",
    "uuid": "2458072c-ffbd-4a7b-a0cc-9b6cd0852667",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#7773ac",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"External Remote Services - T1133\"",
        "relationship_type": ""
      },
      {
        "colour": "#b2a633",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Service Stop - T1489\"",
        "relationship_type": ""
      },
      {
        "colour": "#d4fd6f",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Impair Defenses - T1562\"",
        "relationship_type": ""
      },
      {
        "colour": "#bce57a",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over Web Service - T1567\"",
        "relationship_type": ""
      },
      {
        "colour": "#e00500",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Remote Access Tools - T1219\"",
        "relationship_type": ""
      },
      {
        "colour": "#edf46c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Timestomp - T1070.006\"",
        "relationship_type": ""
      },
      {
        "colour": "#ecc598",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Local Account - T1136.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#0c0051",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"File and Directory Discovery - T1083\"",
        "relationship_type": ""
      },
      {
        "colour": "#755c09",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1059.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#59699c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Valid Accounts - T1078\"",
        "relationship_type": ""
      },
      {
        "colour": "#e08bb2",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"",
        "relationship_type": ""
      },
      {
        "colour": "#36d931",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Data Encrypted for Impact - T1486\"",
        "relationship_type": ""
      },
      {
        "colour": "#30cc3b",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"File Deletion - T1070.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#4c0fbb",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"",
        "relationship_type": ""
      },
      {
        "colour": "#370063",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Remote Desktop Protocol - T1021.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#297c25",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Inhibit System Recovery - T1490\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Local Accounts - T1078.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#35a578",
        "local": false,
        "name": "misp-galaxy:target-information=\"South Africa\"",
        "relationship_type": ""
      },
      {
        "colour": "#15ccfd",
        "local": false,
        "name": "misp-galaxy:target-information=\"France\"",
        "relationship_type": ""
      },
      {
        "colour": "#b8ab01",
        "local": false,
        "name": "misp-galaxy:target-information=\"United States\"",
        "relationship_type": ""
      },
      {
        "colour": "#1faf16",
        "local": false,
        "name": "misp-galaxy:target-information=\"Canada\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:ransomware=\"prinz eugen\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#120044",
        "local": false,
        "name": "rectifyq:sub-category=\"intrusion-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#f1dfed",
        "local": false,
        "name": "rectifyq:TA-category=\"Ransomware\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782442832",
        "to_ids": false,
        "type": "link",
        "uuid": "d2651b5e-298b-4356-88b9-e103fc0f70ca",
        "value": "https://www.threatdown.com/blog/prinz-eugen-ransomware-a-deep-dive-into-a-new-go-based-encryptor/",
        "Tag": [
          {
            "colour": "#6b003a",
            "local": true,
            "name": "workflow:todo=\"create-missing-misp-galaxy-cluster\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782442832",
        "to_ids": false,
        "type": "text",
        "uuid": "ac2a292d-bc07-4bad-ba9a-c49497392400",
        "value": "Prinz Eugen is a newly discovered Go-based ransomware family first observed in April 2026, attributed to an actor known as ROOTBOY. The encryptor employs sophisticated techniques including ChaCha20-Poly1305 encryption, prioritizes recently modified files to maximize pressure on victims, and implements anti-forensic measures such as memory scrubbing and self-deletion. Unlike typical ransomware, it leaves no ransom note on disk, conducting all extortion communications out-of-band through leak sites and direct contact. The threat actor gains initial access through compromised RDP credentials, uses legitimate RMM tools like RemotePC for persistence, and creates backdoor admin accounts. Victims span multiple countries and sectors, with notable incidents including Standard Bank Group in South Africa and Transitions Pro Centre Val de Loire in France."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782442832",
        "to_ids": false,
        "type": "text",
        "uuid": "b8e9e125-0f8b-4b0b-9de2-be24d2a0c3cc",
        "value": "Name: Prinz Eugen ransomware: a deep dive into a new Go-based encryptor\nAuthor: AlienVault\nAdversary: ROOTBOY\nTags: [\"prinz eugen\", \"rootboy\", \"go-based\", \"remotepc rmm\"]\nTgtd countries: [\"South Africa\", \"France\", \"United States of America\", \"Canada\"]\nMlwr families: [\"Prinz Eugen\"]\nAttack_ids: [\"T1133\", \"T1489\", \"T1562\", \"T1567\", \"T1219\", \"T1070.006\", \"T1136.001\", \"T1083\", \"T1059.001\", \"T1078\", \"T1027\", \"T1486\", \"T1070.004\", \"T1105\", \"T1021.001\", \"T1490\", \"T1078.003\"]\nIndustries: [\"Finance\", \"Government\", \"Education\"]"
      },
      {
        "category": "Attribution",
        "comment": "Adversary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782442832",
        "to_ids": false,
        "type": "threat-actor",
        "uuid": "2d7ec37e-743e-4527-afcc-dc086c34b5df",
        "value": "ROOTBOY"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782528922",
        "to_ids": true,
        "type": "domain",
        "uuid": "e4c0146f-70b0-4b7f-8f3a-f6d8993d6818",
        "value": "6cudc5cqa2bjpwdhcwm2lj6dbqejjjqzeo6ipwvmbazr6cgu7vfk3dad.onion",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782528943",
        "to_ids": true,
        "type": "domain",
        "uuid": "beb5effc-151d-4b8b-8056-c486728c85ad",
        "value": "stndrdbnk.cc",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782528965",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "e2b736fb-3f36-42d9-9b68-2691de3fda3a",
        "value": "212.80.7.74",
        "Tag": [
          {
            "colour": "#ba8d86",
            "local": false,
            "name": "asn:asn=\"215439\"",
            "relationship_type": ""
          },
          {
            "colour": "#d731eb",
            "local": false,
            "name": "asn:as-owner=\"PLAY2GO-NET\"",
            "relationship_type": ""
          },
          {
            "colour": "#e1449b",
            "local": false,
            "name": "asn:as-country=\"GB\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united kingdom\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782528986",
        "to_ids": true,
        "type": "domain",
        "uuid": "76204c80-5c0b-475b-8984-af8230243689",
        "value": "prinzfkbjiazbrur4mjje6mntjc4vydx3iatkkzycufoylqcoo4y7pqd.onion",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782529007",
        "to_ids": true,
        "type": "url",
        "uuid": "fc65cd40-e25e-41e3-969c-ff403166398f",
        "value": "https://212.80.7.74/serverscan.ps1",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782529028",
        "to_ids": true,
        "type": "url",
        "uuid": "08e73eb9-00a2-4453-b671-a69452e51bb0",
        "value": "https://212.80.7.74/stager/mini",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782529049",
        "to_ids": true,
        "type": "url",
        "uuid": "3a9034f2-c442-48ef-a942-26f0212ca278",
        "value": "https://212.80.7.74/stager/ps1",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782529070",
        "to_ids": true,
        "type": "domain",
        "uuid": "61571de1-3e80-4669-a18c-ba93e5d19157",
        "value": "captchafestung.sbs",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782529091",
        "to_ids": true,
        "type": "domain",
        "uuid": "64853051-436b-460e-8b37-e11afb441fcf",
        "value": "darkempire.fun",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782529112",
        "to_ids": true,
        "type": "domain",
        "uuid": "5fbea684-4c52-408b-b788-0d1627a8f5d6",
        "value": "g-captchafestung.sbs",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782529133",
        "to_ids": true,
        "type": "domain",
        "uuid": "8ed9f51c-c5d6-4b5d-9ea7-beed7ed0ea9e",
        "value": "old-pidop.ru",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782442832",
        "to_ids": true,
        "type": "email-src",
        "uuid": "5214323b-9c2f-435f-8ecd-0b11e1f8d87a",
        "value": "prinzeugen@mail2tor.co"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782442832",
        "to_ids": true,
        "type": "email-src",
        "uuid": "b5e50558-6ad0-4701-8970-b4bcde97cb6f",
        "value": "standardbankcc@cock.li"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782529154",
        "to_ids": true,
        "type": "hostname",
        "uuid": "26ad0a3b-e7ef-4a75-80f3-3205d61b5d96",
        "value": "festung-e.duckdns.org",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Financial fraud",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782446053",
        "to_ids": true,
        "type": "btc",
        "uuid": "29c41543-d68b-4040-af94-e3caf334c9ca",
        "value": "bc1q2ztpcvqdaptej6uu2ywt9mrlatx6envu34rf0v"
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782529175",
        "uuid": "4ca2c9c7-9ed4-41ef-a614-2668d2f73c71",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782529175",
            "to_ids": true,
            "type": "md5",
            "uuid": "24cfc249-5881-4a81-9602-976378422d6e",
            "value": "17dd3f59f13f54a34761cef0c2b73cd7",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782527980",
            "to_ids": true,
            "type": "sha1",
            "uuid": "880c3de3-2801-49de-b8c1-54fd455066f0",
            "value": "9d94e2a15b75e1ef4487429ac71fc13e186c4a2d",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782527980",
            "to_ids": true,
            "type": "sha256",
            "uuid": "1ab1d4dd-9929-42b1-99c3-2bb038306042",
            "value": "686213cc11d36af764de824801bced9366dfca3823fe0d51b752f74149bcf1f4",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782525540",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "ec35b870-c3a3-46d6-9640-c498cabccdbe",
            "value": "49152:NBhnHLUEFSOznjNZR0OVQXQFvCa3bU3btaIkw5dm/mj39MAQgB3:NBpAA1yDbNkw5AmjN3B"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782525540",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "bad17058-9bf5-4228-b8ef-649a854e108b",
            "value": "3679232"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782525540",
            "to_ids": true,
            "type": "vhash",
            "uuid": "bc409751-6f7f-4df5-a851-b5fb1b982da1",
            "value": "036106655d55551555757az3-z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782525540",
            "to_ids": true,
            "type": "filename",
            "uuid": "7030d6eb-6cfe-464c-8cc3-fbbd1b8be44b",
            "value": "g662i3a.exe.bin"
          },
          {
            "category": "Other",
            "comment": "Checked: 27/06/2026\nLast-scan\t:  24/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782525540",
            "to_ids": false,
            "type": "text",
            "uuid": "b0a22b8f-8000-478f-af1e-300fcc44f52b",
            "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nVT Total Detection:35/70\nFirst Submission:2026-06-08T14:11:26.000000+00:00\nLast Submission:2026-06-22T12:45:27.000000+00:00"
          }
        ]
      }
    ]
  }
}