>Communications with the C2 server are performed via HTTPS: kdvm5fd6tn6jsbwh[.]onion[.]to (185[.]100[.]85[.]150) located in Romania.
That's just a tor tunnel, IP and location doesn't matter.
That's just a tor tunnel, IP and location doesn't matter.
Though it does make me think that it would be a good trick to offer this 'service', but then keep all the proceeds (everyone gets the same ransomware download). Maybe less profitable on the long term though.
Surely antivirus are not just trying to match the SHA1 of executables with SHA1 of known virus/malware, otherwise it would be trivial to bypass them.
I'm guessing those kind of approaches have largely gone away, being replaced with signatures that are hopefully fuzzier than a wholesale cryptographic hash, but still essentially only catching things after the fact, which works well with subscription business models.