MAJINAHANASHI RANSOMWARE: Yet Another Japanese Locker

What it is

MAJINAHANASHI (parsed as MAJIN "djinn/ghost" + AHANASHI "story") is a ransomware group whose data leak site first posted victims on 27 June 2026, with 15 victims by August 2026. The name-analysis places it alongside other Japanese-themed lockers YUREI, SINOBI, and TENGU. This report adds file-server and communication-channel IOCs beyond the initial analysis.

How it works

The C/C++ samples (two spotted, ~90KB, creation date 2 July 2026) encrypt files in place with per-file AES-256 keys wrapped by an embedded RSA public key, using AES-NI hardware acceleration with a software fallback. Command execution runs through a thin wrapper that builds command lines and calls CreateProcessA. Beyond deleting shadow copies, it clears event logs and disables hibernate/System Restore/boot recovery. The lock screen is drawn with GDI in Segoe UI and forced via a 1920×1080 BMP written to registry.

Preconditions / Affected

Windows hosts. Note the ADMIN$\Temp\majin.exe drop path — the binary is staged over the admin share for remote execution, implying lateral movement using existing admin credentials, not just local detonation.

What to do

The summary already lists the core IOCs. This page adds several the summary does not carry — add these to detections:

• C:\1\service.log — log file written by the sample
• ADMIN$\Temp\majin.exe — remote-execution drop via admin share
• C:\ProgramData\majin.bmp and C:\majin.bmp — generated wallpaper BMPs
• DLS onion: lthicpjqc7gkn5eq3epxndc2uig3yngvcbdya4u3m3byjod5km4yuwqd.onion (non-vanity; math-CAPTCHA gated, 30-day session)

Victimology for targeting/exposure triage: exclusively non-US, non-English-speaking — Switzerland, Italy, Germany, Bulgaria, India, Portugal, France, Chile, Lithuania, Thailand, Colombia. Top sectors are E-Commerce and Manufacturing, then Agriculture, Services, Technology. Top victim revenue ~$61M (Switzerland); average ~$25M.

Caveats

• The author corrected the article: the group contacted them to state they have no US victims — earlier claims of US targeting were retracted.
• "Hello world" / "I love bulgaria" strings in the News section may be misdirection, a personal note, or an unfinished project — not confirmed attribution signal.
• No contact details are published on the DLS, which the author reads as either early-stage operation or deliberate low profile.
• The report is explicitly framed as initial intelligence gathering; the referenced YARA rule and full ransom-note text are sections in the original not reproduced in the fetched excerpt.