General
-
Target
true.bin.zip.zip
-
Size
22KB
-
Sample
200603-rwvxmevrl6
-
MD5
7f73b07a0c52b052ca1fd3769b60644f
-
SHA1
ab81078b62d2efd308134af23de2204779624866
-
SHA256
91128776769d4f78dd177695df610463a0b05e2174ba76d0489b976b99cae223
-
SHA512
0b23e96abf5d3533e90d3ef251949a8ce5774c6c901bc5a16ad0f927a5683e516135f6f7e4c41e52989c44eafa0b8fee279c22f1c7d00a77f18bdc2f0a5fa226
Static task
static1
Behavioral task
behavioral1
Sample
true.bin.exe
Resource
win7v200430
Behavioral task
behavioral2
Sample
true.bin.exe
Resource
win10v200430
Malware Config
Extracted
C:\Users\Public\Documents\RGNR_CB6AAE3E.txt
ragnarlocker
http://p6o7m73ujalhgkiv.onion/?p=171
http://mykgoj7uvqtgl367.onion/client/?6bECA2b2AFFfBC1Dff0aa0EaaAd468bec0903b5e4Ea58ecde3C264bC55c7389E
http://p6o7m73ujalhgkiv.onion/?page_id=171
Targets
-
-
Target
true.bin
-
Size
47KB
-
MD5
3ca359f5085bb96a7950d4735b089ffe
-
SHA1
60747604d54a18c4e4dc1a2c209e77a793e64dde
-
SHA256
7af61ce420051640c50b0e73e718dd8c55dddfcb58917a3bead9d3ece2f3e929
-
SHA512
67ac9a483062f42b984f8d2798a02461f27a718f5b93b6f84645170b65e8edbbfddae52c8bee4fd6735fea0e977d8615d1d5c49481e4fbf1480e5e2113af0426
Score10/10-
RagnarLocker
Ransomware first seen at the end of 2019, which has been used in targetted attacks against multiple companies.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Modifies service
-