General
-
Target
ragnar_locker_Omniga.de_
-
Size
5.9MB
-
Sample
200803-b9r4hl2gba
-
MD5
8d986c2f6a23ad4b1624f6e3ee55d3a2
-
SHA1
50ae8d51e9bc3fc5264c7ff2d0b18b68e8164f84
-
SHA256
cf5ec678a2f836f859eb983eb633d529c25771b3b7505e74aa695b7ca00f9fa8
-
SHA512
11736427ffeef18686968b798a9d123151f0e9f031d6b6f5bf473da4dea1ea74b466b6437d2b87fd8fa571f0f786e179838e8821d30922a54c711ebcd9973dc7
Static task
static1
Behavioral task
behavioral1
Sample
ragnar_locker_Omniga.de_.exe
Resource
win7
Behavioral task
behavioral2
Sample
ragnar_locker_Omniga.de_.exe
Resource
win10v200722
Malware Config
Extracted
C:\Users\Public\Documents\RGNR_F0C1BF83.txt
ragnarlocker
https://prnt.sc/s5g6gr
https://prnt.sc/s5g79t
https://prnt.sc/s5gkxh
http://p6o7m73ujalhgkiv.onion/temporary-de-page-424/
http://stppd5as5x4hxs45.onion/client/?0dFE0B7BAA7C7801ddd746B1DC5ad44bAD82Fc0f77DAC01bD3cf3D2D9deB94bC
Targets
-
-
Target
ragnar_locker_Omniga.de_
-
Size
5.9MB
-
MD5
8d986c2f6a23ad4b1624f6e3ee55d3a2
-
SHA1
50ae8d51e9bc3fc5264c7ff2d0b18b68e8164f84
-
SHA256
cf5ec678a2f836f859eb983eb633d529c25771b3b7505e74aa695b7ca00f9fa8
-
SHA512
11736427ffeef18686968b798a9d123151f0e9f031d6b6f5bf473da4dea1ea74b466b6437d2b87fd8fa571f0f786e179838e8821d30922a54c711ebcd9973dc7
Score10/10-
RagnarLocker
Ransomware first seen at the end of 2019, which has been used in targetted attacks against multiple companies.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Modifies service
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-