Overview

overview

10

Static

static

8

l.exe

windows7_x64

10

l.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    l.exe
  • Size 5.4MB
  • Sample200923-4ffb1p7b6j
  • SHA256 4110e5497ebc7f2f587412c08967e815d142494a1027ef235c375d2841bc0b6a
  • MD5 SHA1 SHA512
Score
10/10
ragnarokevasionpersistenceransomwarespywarevmprotect

Malware Config

Extracted

Path

  • C:\!!ReadMe_To_Decrypt_My_Files.txt

  • ragnarok

Ransom Note
  • It's not late to say happy new year right? but how didn't i bring a gift as the first time we met :) #what happend to your files? Unfortunately your files are encrypted with rsa4096 and aes encryption,you won't decrypt your files without our tool but don't worry,you can follow the instructions to decrypt your files 1.obviously you need a decrypt tool so that you can decrypt all of your files 2.contact with us for our btcoin address and send us your DEVICE ID after you decide to pay 3.i will reply a specific price e.g 1.0011 or 0.9099 after i received your mail including your DEVICE ID 4.i will send your personal decrypt tool only work on your own machine after i had check the ransom paystatus 5.you can provide a file less than 1M for us to prove that we can decrypt your files after you paid 6.it's wise to pay as soon as possible it wont make you more losses the ransome: 1 btcoin for per machine,5 bitcoins for all machines how to buy bitcoin and transfer? i think you are very good at googlesearch [email protected] [email protected] [email protected] Attention:if you wont pay the ransom in five days, all of your files will be made public on internet and will be deleted YOUR DEVICE ID: AwCLaVESJtkSMVEL4gjR3Y0NxEDMygTOGFTM2YUM0MzN0kDO2MDMDN0MEFTQFJEOxEjM5MTMzEENyUTN5MUO5ATNEVjNzgzM5QUN0YzNFZ0QxU0NGRzMxQTOChzN0EkQzgjQ5gDOFdTQFhjR3IENFZEO1MjNxQDNxYEO5YTOxIDN4gDOzMTO0ADN5EzMxUUM4MzM5gzQ4QENEFzM4QkNxMUO1MDMCNUNycjNyEzMycTM5EDN3IEOBFUNBVkNzIzMEVzQ3YkRwI0N0M0N2QTNBlTNBZUNFRzQClDMxkTRCdzNChjRzMDMDNzMEJkNFRDR5YDR4QDRzQkMEJUMCVkNERTOyEERyAjRCdTQ4ITMGZTRCNDO3U0NyU0MyQzM1ATN2EER1UzN5QUR0kjMGZ0NGVTODV0QDVDOykTN3YjQ4YDOCFTMyIjQyUEO3EEN1EzN2kTN4UjRCRkN3MkQwEUM5MkR5YDMzMzM5EUNyITNFRjQ3UkM3E0N2QEOwEURxADR3E0NCFTN3Q0N4kzQwgzMCdzQ5gTNGFTNDJ0NDdjM4I0QzIUQ5M0M5gDN2UEMCJUQxUzQGJERxQkRGhDO1Q0M4IkM5cjQ3YENxkjNCNENCFUR0YTNBNEO0MzNBNzQChjMyQkNDRURFNERzIDNxEkRGRUNGJDOGZUR4QTMyUTNwI0MwEDO0YTM0EkQzMTQGZzM3QTO2gzQ5UENBF0Q1cTQ5ATQFVUMFNjNyUENFJUMBZER4MkRBljQzMUMDlDR0IkNCVkR0IERzYERCFTM0UDR2ATOFhDO3U0MCZkNDNEOGVUQ1MjMCRDMGBjQxIjRyETREdjM1kzQ1M0M2QzM3MTR5cTNxgTQDFER4gTQFNUREJ0QFVUQ3IUR5ETOCFjMBhTR0YDOFZUM2YDOGVTRGNEMDFzN4IkNCBzQBBDN0YDRDFDRwUEMBJzNGZURFVUM0EzQ1EkQzgDRBlTRyATM0EzQ3UkMwMkMyMkQBRTN1IDR5EDRygDR0czMEF0Q1YUMBhDMChTMGFzNxYUMCRDMFhTOENUQBJzQ0UUR3AjQ3Y0QElDN0kjRzIkN5MUMCNTMDVUN2cjMDhjN5QTMxQjMCRjR1YjRFJkNyUTO5kjMzYkQFNDNzAjM5cjQ4kjRyIkRycDRygTO2gTRwMjMyQjNzI0M2gTM2MTMzIkMwQ0NDRDRzQzNEZjMDJkQBJEM4EjR3gTNyEkN5kTO0IzQFJERBNjNxgzM4EER0MTR5E0M3ETNBFkNBlDR2MkNBdDOCRUMBZjRCFjREdTQDlDMDNEO0QEN5gzM2IzM1kjQ5UUQxQTNDR0N2YjRyEzQ4IURxUDN

Extracted

Path

  • C:\!!ReadMe_To_Decrypt_My_Files.txt

  • ragnarok

Ransom Note
  • It's not late to say happy new year right? but how didn't i bring a gift as the first time we met :) #what happend to your files? Unfortunately your files are encrypted with rsa4096 and aes encryption,you won't decrypt your files without our tool but don't worry,you can follow the instructions to decrypt your files 1.obviously you need a decrypt tool so that you can decrypt all of your files 2.contact with us for our btcoin address and send us your DEVICE ID after you decide to pay 3.i will reply a specific price e.g 1.0011 or 0.9099 after i received your mail including your DEVICE ID 4.i will send your personal decrypt tool only work on your own machine after i had check the ransom paystatus 5.you can provide a file less than 1M for us to prove that we can decrypt your files after you paid 6.it's wise to pay as soon as possible it wont make you more losses the ransome: 1 btcoin for per machine,5 bitcoins for all machines how to buy bitcoin and transfer? i think you are very good at googlesearch [email protected] [email protected] [email protected] Attention:if you wont pay the ransom in five days, all of your files will be made public on internet and will be deleted YOUR DEVICE ID: AwCLV9USMtUVaxEL3EzMGV0NGVkQ3cTREFURGRzMyYTODJkMykjQ1cDO4IkMCNjMEFDNFFTODZEMyYUOGRjMCZENBJUMyM0QCZzN0UTM1YjRyEjRDlTMENDO2UjR4gjN1cjMFNUO0EkQ1EEN2YzMDJkQ0QzNCVURCNURyUkM4YjQzYDR2IERCdjQwUUQ1MjM0IzQFZUR5Q0QxgjQEJTMCVUN1MDN2Q0MBljQykzM1kTO5EzNzATR2QkNDJkQ4kTQ5QUO0QzNxIjM1QkMBhzN4EDRGVUOzIDMGJUM5EjQEdjRGJkR5ATMwUER5QTO4QkM5cDR0UTMGNjMGFjR3kDR4ITRCJTR1MDR0U0Q3UTO3UjQGRDR0YkQ2gDNwMUO1gTQwQTMzEUO5kjQFVTN4IENzUjQ5YDMCdTM0QzM2gjM1YDRFV0MyYkNEJ0Q1YjQ4UjMzEjMENURBBDO0kTRxYUR1UEN5MjN0gDNFZzMzEDO0AjQxgjMykTMEZjQ5AjR1IDNFZUNBlDNzkDRBR0Q2kjMBZTOxQjRFN0MzgTOxIzQzIUMyMzN1UkM4UTMBhDOERzN1UEO3QTQElDOzUUQEREOxUUOBJkRxUjQ1QkNyMkQ3MzNCVDR1UkN4YzMwQUR1UzQEJzNBNUQ5MzMFRERwMkNCRDR0gDRCNjMyE0QwIzN1Q0NEdDMBRjRCNkNBdTMyYENDV0M5IDOxMTRGJzQFN0Q5MkM1MDOyYTQBJjNzIkMBBjQChjQ3gzQ4UkN3kTR5UjMyUzM5IDRyM0N4UTNBJTN0EkN5ETMBFURBVDOGFTR1ETMDJ0NElDR4AzM2EzMGhTR0IjRDdzQDJDO3EUQzMkQzUzNFV0Q3IUQ1QjQ1IEMCNEOxYjMxQzQFZjMzIjN1QEMzI0N3YjNEhjN0IUNwcTQBlTQyIDO5MTRBNjM5EUQ0UTN4MUQCNjQ5EUQ3cTQ2EUN5IzMCNUOFNkM2EjQBZERBNDM4YUR1IDM5kzM0EjNyMTMDFTMGhjNDNEOyIzQ0QjMzQUOxcTM4YDN1MTM1YDR3QjN4gzM2UTOERkN2gDR1YUQGlDODVkRzITNzYTOChDNFZkMDZUQxYDN0QENEhjQ5YDN3UkR5Y0NERDMGNER3kzNwIjQyIUR3MURFdjRxcDM4EzN5EEOGlTOxEzN2gjNDVzN3UEO4IENxIUMykTQDRkM5MTQ4UTMxIjQ4QjM4IUQxcDMxIzQCZ0MxEEOBNjMyIUMxYENEFkQ2IjN0YUQ2EkNyIjQ0IzMxkzQ1UjN1UTOzQEMxMTM0E0NEZzMDFjNwUUM3MTRyIDMGVTOxEER5IUMzMUOFhjQ5EUNBFTO

Targets

    • Target
      l.exe
    • Size 5.4MB
    • SHA256 4110e5497ebc7f2f587412c08967e815d142494a1027ef235c375d2841bc0b6a
    • MD5 SHA1 SHA512
    Score
    10/10
    ransomwareevasionragnarokpersistencespyware

    • Ragnarok

      Ransomware family deployed from Citrix servers infected via CVE-2019-19781.

      ransomwareragnarok

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Modifies boot configuration data using bcdedit

      ransomwareevasion

    • Modifies Installed Components in the registry

      persistence

    • Modifies Windows Firewall

      evasion

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Modifies service

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks