everest

T1027Obfuscated Files or Information

Binary protected with ConfuserEx: rename obfuscation, constants encryption, integer confusion, and modified module .cctor.

T1027.007Obfuscated Files or Information: Dynamic API Resolution

All non-corlib native API calls resolved at runtime via LoadLibrary / GetProcAddress rather than static imports.

T1078.003Valid Accounts: Local Accounts

Implicit current-user impersonation used for net use \\<unc> connections to discovered network shares without explicit credential passing.

T1112Modify Registry

Multiple HKCU/HKLM registry writes: LongPathsEnabled, LocalAccountTokenFilterPolicy, EnableLinkedConnections (share access), WallPaper (ransom note), AppName\PublicKey (encryption key storage).

T1140Deobfuscate/Decode Files or Information

Runtime decryption of UserStrings via <Module>.m using GZip decompression followed by Base64 decoding.

T1480Execution Guardrails

Global <GUID> mutex enforces single-instance execution; CIS culture/LCID geo-fence prevents execution on CIS-locale systems.

T1564Hide Artifacts

Process self-DACL set to deny-Everyone via KZsyzkgZlDQw.UB, preventing other processes from inspecting or terminating the ransomware process.

T1622Debugger Evasion

Memory-pig killer heuristic: processes consuming more than 250 MB are terminated, targeting sandbox environments and active debuggers.

T1018Remote System Discovery

ARP table parsed via arp -a; ARP-driven Wake-On-LAN packets sent to discovered hosts to bring them online before encryption.

T1135Network Share Discovery

Network shares enumerated via net view, NetDfsEnum, WNetEnumResource*, Win32_Share WMI class, and Win32_NetworkConnection.

T1518.001Software Discovery: Security Software Discovery

Anti-analysis kill list matched against ProcessName and MainWindowTitle to identify and terminate security/analysis tools.

T1614.001System Location Discovery: System Language Discovery

CIS culture/LCID check used as exclusion geo-fence; execution aborts if system locale matches CIS-region languages.

T1021.002Remote Services: SMB/Windows Admin Shares

net.exe use \\<unc> executed over discovered SMB shares to access and encrypt remote file systems.

T1071.001Application Layer Protocol: Web Protocols

WebClient.DownloadData referenced in Helpers.DownloadUrl — present in code but not reachable at runtime (inert code path).

T1486Data Encrypted for Impact

AES-128-CBC PKCS#7 / NoPadding (large files) encryption of all eligible files on local drives, mounted unlettered volumes, and LAN shares.

T1489Service Stop

ServiceController.Stop called against ~100 services (AV, backup, MSSQL, Exchange, MBAM, Veeam, Acronis, etc.) combined with sc config <svc> start=disabled to prevent restart.

T1490Inhibit System Recovery

VSS deletion via PowerShell or vssadmin, SRRemoveRestorePoint, backup file deletion (del /s /q), Recycle Bin removal (rd /s /q), Restart Manager used to force-shutdown apps locking target files.