INC Propose Change

According to Ireneusz Tarnowski, INC Ransom is a Rust-based ransomware family that employs a hybrid cryptographic scheme using X25519 (ECDH) and AES-CTR, generating a unique key per file with AES-NI hardware acceleration support and a software fallback. The malware uses a multithreaded producer-consumer architecture with asynchronous I/O Completion Ports for parallel file encryption and leverages the Windows Restart Manager to terminate processes holding locks on in-use files such as databases. It excludes system directories (Windows, Program Files, ProgramData, AppData) and file extensions (.exe, .dll, .log) from encryption to maintain system operability, and can stop services via the Windows Service Control Manager to disable security software and business applications.

References

There is no Yara-Signature yet.