The article presents a detailed analysis of a newly identified ransomware family named “Ymir.” The investigation reveals the advanced capabilities of Ymir in evading detection, primarily due to its operations being conducted in memory through various function calls, such as malloc, memmove, and memcmp. The initial access point for attackers was through PowerShell remote control commands, which allowed them to install malicious tools before executing the ransomware. In the static analysis of the Ymir binary, the sample exhibited characteristics typical of ransomware, including specific API calls related to cryptographic functions and process management. Noteworthy elements included API calls for functions like CryptAcquireContextA and WinExec, which are prevalent in ransomware variants. The analysis further uncovered essential strings in the binary, such as the ransom note filename and encryption extension, as well as commands for PowerShell, indicative of its operational...