IronLantern remediation tool for Yogi malware

Yogi is a Windows malware implant written in Python 3.9 and packaged with PyInstaller. It achieves persistence via HKCU Run registry keys and startup folder entries, placing randomized copies under %APPDATA%\Microsoft\Crypto with hidden/system attributes. The malware uses JSON-based HTTP(S) communication with C2 servers at go-ns.org.ua and employs a repeating-XOR ransomware encryption with deterministic keys derived from SHA-256. IronLantern is a defensive remediation tool developed from reverse engineering Yogi, capable of exact sample detection, persistence cleanup, live process termination, quarantine/deletion, and file recovery of XOR-encrypted files. The analysis and tool are community-shared without an official vendor patch or advisory.

Yogi malware can persist on infected Windows systems, encrypt user files using a repeating-XOR ransomware method, and communicate with remote command and control servers to receive commands and report status. This can lead to data encryption and potential data loss if not remediated. However, no active exploitation in the wild has been reported, and a community-developed remediation tool exists to detect and recover from infections.

No official vendor patch or advisory is available. The IronLantern remediation tool developed by the reverse engineer is publicly available and provides detection, persistence removal, process termination, and file recovery capabilities specific to Yogi malware. Users infected with Yogi should consider using IronLantern for remediation. Monitor the GitHub repository for updates and community feedback. Follow standard incident response procedures when handling infected systems.