Technical Analysis of PartyTicket Ransomware

This report analyzes PartyTicket, an unsophisticated Go-based ransomware observed alongside the Hermetic Wiper targeting Ukrainian organizations; it enumerates targeted file extensions, explains the file encryption format (AES-GCM with a deterministic 32-character key wrapped by a hardcoded RSA public key), highlights design flaws that allow recovery of the AES key (use of Go's non-cryptographic RNG), documents operational behavior (creates many timestamp/MAC-based UUID-named copies, skips System/Program Files, appends a distinct marker, and leaves a read_me.html ransom note), and notes Zscaler detection coverage for the payloads.