Dissecting Rancoz Ransomware

This report analyzes the Rancoz ransomware, a rebranded variant with similarities to Vice Society, describing its manual execution, command-line options, destructive post-compromise actions (Shadow Copy and RDP deletions), multi-threaded file encryption using ChaCha20-Poly with NTRU asymmetric protection, ransom note deployment, desktop-lock changes, exclusions, and provided IOCs and mitigation recommendations.