General
-
Target
ragnar_locker_EDP (3)
-
Size
116KB
-
Sample
200803-jnqscjbp5x
-
MD5
6d122b4bfab5e75f3ae903805cbbc641
-
SHA1
5197d1b54494f8cb043759b35e097c660a9e09ac
-
SHA256
68eb2d2d7866775d6bf106a914281491d23769a9eda88fc078328150b8432bb3
-
SHA512
06621ff8e96fc2063f899321455dfdc264de3e2a820dd4b39d40f903ccd5e207ce5b17f08621ecb44aeb60432088e6875ed7e6888dbe9f34f71c5070a23552b4
Static task
static1
Behavioral task
behavioral1
Sample
ragnar_locker_EDP (3).exe
Resource
win7v200722
Behavioral task
behavioral2
Sample
ragnar_locker_EDP (3).exe
Resource
win10
Malware Config
Extracted
C:\Users\Public\Documents\RGNR_AC7AABB2.txt
ragnarlocker
http://p6o7m73ujalhgkiv.onion/?p=171
http://mykgoj7uvqtgl367.onion/client/?6bECA2b2AFFfBC1Dff0aa0EaaAd468bec0903b5e4Ea58ecde3C264bC55c7389E
http://p6o7m73ujalhgkiv.onion/?page_id=171
Targets
-
-
Target
ragnar_locker_EDP (3)
-
Size
116KB
-
MD5
6d122b4bfab5e75f3ae903805cbbc641
-
SHA1
5197d1b54494f8cb043759b35e097c660a9e09ac
-
SHA256
68eb2d2d7866775d6bf106a914281491d23769a9eda88fc078328150b8432bb3
-
SHA512
06621ff8e96fc2063f899321455dfdc264de3e2a820dd4b39d40f903ccd5e207ce5b17f08621ecb44aeb60432088e6875ed7e6888dbe9f34f71c5070a23552b4
Score10/10-
RagnarLocker
Ransomware first seen at the end of 2019, which has been used in targetted attacks against multiple companies.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Modifies service
-