ThreatDown Details Prinz Eugen Ransomware’s Encryption and Anti-Forensic Tactics

Jun 22, 2026 · Original article ↗

Summary

ThreatDown analyzes Prinz Eugen, a Go ransomware sample observed on an infected customer, detailing recursive encryption, suspected RDP access, RemotePC-assisted payload staging, and self-deletion. The report links activity to ROOTBOY but notes attribution caveats.

Key points

The analyzed Go encryptor recursively targets files, prioritizes the most recently modified, and can delete originals after verifying encrypted output.
It uses ChaCha20-Poly1305, per-file random IVs, an Argon2id-to-SHA-256-to-HKDF-SHA256 key derivation chain, 1 MB chunks, and a custom CHV1 file header.
The sample contains no ransom-note functionality; before exiting, it zeroes its hardcoded key, runs garbage collection, and deletes itself.
Researchers suspect compromised RDP credentials provided initial access in the investigated environment. They observed RemotePC used to launch PowerShell stagers and creation of an admin account named “germania.”
The researchers link activity to ROOTBOY using evidence including the “germania” string, shared account identifiers, and public leak-site tracking. They note that the affiliate label and possibility of a separate encryptor developer leave attribution caveats.
The article cites separate reporting on Standard Bank Group describing data exfiltration and extortion; those claims are presented as reporting, not as findings independently established by the sample analysis.

Article Details

Attack Vectors: The researchers suspect the operator gained initial access using compromised RDP credentials; the entry point was not confirmed.
The encryptor, servertool.exe, was downloaded using Chrome and moved to the user's Music folder.
RemotePC was used to launch PowerShell stagers and deploy additional payloads downloaded from the reported C2 address.
The actor created a local admin account with the command `net user admin germania /add`.
Prinz Eugen recursively encrypted files, prioritizing the most recently modified files; the sample could delete originals after verifying the encrypted files.
Reporting on the Standard Bank incident described data exfiltration followed by staged daily leaks, but did not specify the exfiltration method.
Defensive Notes: ThreatDown Endpoint Protection blocked the ransomware execution in the investigated environment.
ThreatDown EDR surfaced alerts for the suspicious account creation and RemotePC's PowerShell activity.
The article says ThreatDown anti-ransomware and Ransomware Rollback capabilities could restore affected files.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`festung-e[.]duckdns[.]org`	Dynamic-DNS host reported as resolving to the C2 IP and observed between May 23 and 30.
DOMAIN	`g-captchafestung[.]sbs`	Reported fake-CAPTCHA domain resolving to the C2 IP; a ClickFix lure was suggested but remained unconfirmed.
DOMAIN	`stndrdbnk[.]cc`	Standard Bank typosquat that resolved to the reported C2 IP and was observed serving an /unlocked portal.
EMAIL	`prinzeugen@mail2tor[.]co`	Listed as an actor selector associated with the Prinz Eugen activity.
EMAIL	`standardbankcc@cock[.]li`	Listed as an actor selector associated with the reported activity.
IPV4	`212[.]80[.]7[.]74`	Reported C2 and admin-panel host; also associated with payload delivery.
SHA256	`686213cc11d36af764de824801bced9366dfca3823fe0d51b752f74149bcf1f4`	SHA-256 hash listed for the ransomware payload.
URL	`hxxps[:]//212[.]80[.]7[.]74/serverscan.ps1`	PowerShell stager URL listed among the payload URLs associated with the reported C2 host.
URL	`hxxps[:]//212[.]80[.]7[.]74/stager/mini`	Payload URL listed as part of the actor's reported staging infrastructure.
URL	`hxxps[:]//212[.]80[.]7[.]74/stager/ps1`	PowerShell payload URL listed as part of the actor's reported staging infrastructure.