General
-
Target
birch_ragnarlocker
-
Size
49KB
-
Sample
200801-7lxn89dqex
-
MD5
3dabfb99101821ae0e89389a9c9d28a5
-
SHA1
72b19c503a642770945355ea0dce96bf9d735f81
-
SHA256
1602d04000a8c7221ed0d97d79f3157303e209d4640d31b8566dd52c2b09d033
-
SHA512
131487a835f81a774b43155364a683b054b342c5176fe19264a4f9a510c6571532b1cb081011a09f733dee836192240cd36b419979832a601001b14ccbc5ff18
Static task
static1
Behavioral task
behavioral1
Sample
birch_ragnarlocker.exe
Resource
win7v200722
Behavioral task
behavioral2
Sample
birch_ragnarlocker.exe
Resource
win10
Malware Config
Extracted
C:\Users\Public\Documents\RGNR_AC7AABB2.txt
ragnarlocker
https://prnt.sc/sfle2v
http://prnt.sc/sflk1s
http://prnt.sc/sflkc8
http://prnt.sc/sflkn2
http://p6o7m73ujalhgkiv.onion/2020/03/18/leaks-from-communicate-giant/
http://rgngerzxui2kizq6h5ekefneizmn54n4bcjjthyvdir22orayuya5zad.onion/client/?6C3B93D0480953d13302f18DD4a6C0C4e59cDae6D4f88Ed5c98cE8fCD0F9D6cE
Targets
-
-
Target
birch_ragnarlocker
-
Size
49KB
-
MD5
3dabfb99101821ae0e89389a9c9d28a5
-
SHA1
72b19c503a642770945355ea0dce96bf9d735f81
-
SHA256
1602d04000a8c7221ed0d97d79f3157303e209d4640d31b8566dd52c2b09d033
-
SHA512
131487a835f81a774b43155364a683b054b342c5176fe19264a4f9a510c6571532b1cb081011a09f733dee836192240cd36b419979832a601001b14ccbc5ff18
Score10/10-
RagnarLocker
Ransomware first seen at the end of 2019, which has been used in targetted attacks against multiple companies.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Drops desktop.ini file(s)
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Modifies service
-