Analysis of Elpaco: a Mimic variant

Elpaco is a Mimic-family ransomware variant analyzed here: attackers gain access via RDP brute force, escalate privileges (Zerologon/CVE-2020-1472), deploy a dropper that abuses the legitimate Everything DLL for file discovery, and run a configurable GUI/console that customizes encryption, disables defenses, and self-deletes; the sample uses per-file X25519 key agreement and ChaCha20 encryption, leaves YARA-detectable artifacts, and has been observed in multiple countries.