>Communications with the C2 server are performed via HTTPS: kdvm5fd6tn6jsbwh[.]onion[.]to (185[.]100[.]85[.]150) located in Romania.<p>That's just a tor tunnel, IP and location doesn't matter.
> "Based on the strings present in the PE file, it has been written in Go"<p>I find this kind of interesting. I've seen reports on other malware/virus stuff written in Go recently. I wonder if this is because the ability to cross compile with Go is pretty painless? Or is it because the language is fairly approachable but still allows you to dig a bit "deeper" if you need to?
> The business model behind the service is simple: the bad guys keep 10% of the ransom.<p>Creating a ransomware is indeed not a very nice thing to do, but IMO the ones that deserve the most to be called "bad guys" are the ones that actually spread the binary (so, the ones that keep the other 90%)
Interestingly it does not seem to be a new concept:
<a href="https://www.reddit.com/r/netsec/comments/37ko5v/introducing_raas_ransomware_as_a_service/" rel="nofollow">https://www.reddit.com/r/netsec/comments/37ko5v/introducing_...</a>
<a href="https://securingtomorrow.mcafee.com/mcafee-labs/meet-tox-ransomware-for-the-rest-of-us" rel="nofollow">https://securingtomorrow.mcafee.com/mcafee-labs/meet-tox-ran...</a><p>They used to take 20% 'commission'.