General

  • Target

    l.exe

  • Size

    5.4MB

  • Sample

    200923-4ffb1p7b6j

  • MD5

    d735552452a4c85c6f7cbacb67bafa38

  • SHA1

    94a55c38e34930ac4a11bef628b3678721759179

  • SHA256

    4110e5497ebc7f2f587412c08967e815d142494a1027ef235c375d2841bc0b6a

  • SHA512

    7627870b3f097cd12257f55e1165f4fd4662adb1a9ce88cb2f4198109e11a9ca7c5c5e76c8a5b9072034fae094e71561d49d3e53f7765b8776c861f3d3a70ed4

Malware Config

Extracted

Path

C:\!!ReadMe_To_Decrypt_My_Files.txt

Family

ragnarok

Ransom Note
It's not late to say happy new year right? but how didn't i bring a gift as the first time we met :) #what happend to your files? Unfortunately your files are encrypted with rsa4096 and aes encryption,you won't decrypt your files without our tool but don't worry,you can follow the instructions to decrypt your files 1.obviously you need a decrypt tool so that you can decrypt all of your files 2.contact with us for our btcoin address and send us your DEVICE ID after you decide to pay 3.i will reply a specific price e.g 1.0011 or 0.9099 after i received your mail including your DEVICE ID 4.i will send your personal decrypt tool only work on your own machine after i had check the ransom paystatus 5.you can provide a file less than 1M for us to prove that we can decrypt your files after you paid 6.it's wise to pay as soon as possible it wont make you more losses the ransome: 1 btcoin for per machine,5 bitcoins for all machines how to buy bitcoin and transfer? i think you are very good at googlesearch [email protected] [email protected] [email protected] Attention:if you wont pay the ransom in five days, all of your files will be made public on internet and will be deleted YOUR DEVICE ID: AwCLaVESJtkSMVEL4gjR3Y0NxEDMygTOGFTM2YUM0MzN0kDO2MDMDN0MEFTQFJEOxEjM5MTMzEENyUTN5MUO5ATNEVjNzgzM5QUN0YzNFZ0QxU0NGRzMxQTOChzN0EkQzgjQ5gDOFdTQFhjR3IENFZEO1MjNxQDNxYEO5YTOxIDN4gDOzMTO0ADN5EzMxUUM4MzM5gzQ4QENEFzM4QkNxMUO1MDMCNUNycjNyEzMycTM5EDN3IEOBFUNBVkNzIzMEVzQ3YkRwI0N0M0N2QTNBlTNBZUNFRzQClDMxkTRCdzNChjRzMDMDNzMEJkNFRDR5YDR4QDRzQkMEJUMCVkNERTOyEERyAjRCdTQ4ITMGZTRCNDO3U0NyU0MyQzM1ATN2EER1UzN5QUR0kjMGZ0NGVTODV0QDVDOykTN3YjQ4YDOCFTMyIjQyUEO3EEN1EzN2kTN4UjRCRkN3MkQwEUM5MkR5YDMzMzM5EUNyITNFRjQ3UkM3E0N2QEOwEURxADR3E0NCFTN3Q0N4kzQwgzMCdzQ5gTNGFTNDJ0NDdjM4I0QzIUQ5M0M5gDN2UEMCJUQxUzQGJERxQkRGhDO1Q0M4IkM5cjQ3YENxkjNCNENCFUR0YTNBNEO0MzNBNzQChjMyQkNDRURFNERzIDNxEkRGRUNGJDOGZUR4QTMyUTNwI0MwEDO0YTM0EkQzMTQGZzM3QTO2gzQ5UENBF0Q1cTQ5ATQFVUMFNjNyUENFJUMBZER4MkRBljQzMUMDlDR0IkNCVkR0IERzYERCFTM0UDR2ATOFhDO3U0MCZkNDNEOGVUQ1MjMCRDMGBjQxIjRyETREdjM1kzQ1M0M2QzM3MTR5cTNxgTQDFER4gTQFNUREJ0QFVUQ3IUR5ETOCFjMBhTR0YDOFZUM2YDOGVTRGNEMDFzN4IkNCBzQBBDN0YDRDFDRwUEMBJzNGZURFVUM0EzQ1EkQzgDRBlTRyATM0EzQ3UkMwMkMyMkQBRTN1IDR5EDRygDR0czMEF0Q1YUMBhDMChTMGFzNxYUMCRDMFhTOENUQBJzQ0UUR3AjQ3Y0QElDN0kjRzIkN5MUMCNTMDVUN2cjMDhjN5QTMxQjMCRjR1YjRFJkNyUTO5kjMzYkQFNDNzAjM5cjQ4kjRyIkRycDRygTO2gTRwMjMyQjNzI0M2gTM2MTMzIkMwQ0NDRDRzQzNEZjMDJkQBJEM4EjR3gTNyEkN5kTO0IzQFJERBNjNxgzM4EER0MTR5E0M3ETNBFkNBlDR2MkNBdDOCRUMBZjRCFjREdTQDlDMDNEO0QEN5gzM2IzM1kjQ5UUQxQTNDR0N2YjRyEzQ4IURxUDN

Extracted

Path

C:\!!ReadMe_To_Decrypt_My_Files.txt

Family

ragnarok

Ransom Note
It's not late to say happy new year right? but how didn't i bring a gift as the first time we met :) #what happend to your files? Unfortunately your files are encrypted with rsa4096 and aes encryption,you won't decrypt your files without our tool but don't worry,you can follow the instructions to decrypt your files 1.obviously you need a decrypt tool so that you can decrypt all of your files 2.contact with us for our btcoin address and send us your DEVICE ID after you decide to pay 3.i will reply a specific price e.g 1.0011 or 0.9099 after i received your mail including your DEVICE ID 4.i will send your personal decrypt tool only work on your own machine after i had check the ransom paystatus 5.you can provide a file less than 1M for us to prove that we can decrypt your files after you paid 6.it's wise to pay as soon as possible it wont make you more losses the ransome: 1 btcoin for per machine,5 bitcoins for all machines how to buy bitcoin and transfer? i think you are very good at googlesearch [email protected] [email protected] [email protected] Attention:if you wont pay the ransom in five days, all of your files will be made public on internet and will be deleted YOUR DEVICE ID: AwCLV9USMtUVaxEL3EzMGV0NGVkQ3cTREFURGRzMyYTODJkMykjQ1cDO4IkMCNjMEFDNFFTODZEMyYUOGRjMCZENBJUMyM0QCZzN0UTM1YjRyEjRDlTMENDO2UjR4gjN1cjMFNUO0EkQ1EEN2YzMDJkQ0QzNCVURCNURyUkM4YjQzYDR2IERCdjQwUUQ1MjM0IzQFZUR5Q0QxgjQEJTMCVUN1MDN2Q0MBljQykzM1kTO5EzNzATR2QkNDJkQ4kTQ5QUO0QzNxIjM1QkMBhzN4EDRGVUOzIDMGJUM5EjQEdjRGJkR5ATMwUER5QTO4QkM5cDR0UTMGNjMGFjR3kDR4ITRCJTR1MDR0U0Q3UTO3UjQGRDR0YkQ2gDNwMUO1gTQwQTMzEUO5kjQFVTN4IENzUjQ5YDMCdTM0QzM2gjM1YDRFV0MyYkNEJ0Q1YjQ4UjMzEjMENURBBDO0kTRxYUR1UEN5MjN0gDNFZzMzEDO0AjQxgjMykTMEZjQ5AjR1IDNFZUNBlDNzkDRBR0Q2kjMBZTOxQjRFN0MzgTOxIzQzIUMyMzN1UkM4UTMBhDOERzN1UEO3QTQElDOzUUQEREOxUUOBJkRxUjQ1QkNyMkQ3MzNCVDR1UkN4YzMwQUR1UzQEJzNBNUQ5MzMFRERwMkNCRDR0gDRCNjMyE0QwIzN1Q0NEdDMBRjRCNkNBdTMyYENDV0M5IDOxMTRGJzQFN0Q5MkM1MDOyYTQBJjNzIkMBBjQChjQ3gzQ4UkN3kTR5UjMyUzM5IDRyM0N4UTNBJTN0EkN5ETMBFURBVDOGFTR1ETMDJ0NElDR4AzM2EzMGhTR0IjRDdzQDJDO3EUQzMkQzUzNFV0Q3IUQ1QjQ1IEMCNEOxYjMxQzQFZjMzIjN1QEMzI0N3YjNEhjN0IUNwcTQBlTQyIDO5MTRBNjM5EUQ0UTN4MUQCNjQ5EUQ3cTQ2EUN5IzMCNUOFNkM2EjQBZERBNDM4YUR1IDM5kzM0EjNyMTMDFTMGhjNDNEOyIzQ0QjMzQUOxcTM4YDN1MTM1YDR3QjN4gzM2UTOERkN2gDR1YUQGlDODVkRzITNzYTOChDNFZkMDZUQxYDN0QENEhjQ5YDN3UkR5Y0NERDMGNER3kzNwIjQyIUR3MURFdjRxcDM4EzN5EEOGlTOxEzN2gjNDVzN3UEO4IENxIUMykTQDRkM5MTQ4UTMxIjQ4QjM4IUQxcDMxIzQCZ0MxEEOBNjMyIUMxYENEFkQ2IjN0YUQ2EkNyIjQ0IzMxkzQ1UjN1UTOzQEMxMTM0E0NEZzMDFjNwUUM3MTRyIDMGVTOxEER5IUMzMUOFhjQ5EUNBFTO

Targets

    • Target

      l.exe

    • Size

      5.4MB

    • MD5

      d735552452a4c85c6f7cbacb67bafa38

    • SHA1

      94a55c38e34930ac4a11bef628b3678721759179

    • SHA256

      4110e5497ebc7f2f587412c08967e815d142494a1027ef235c375d2841bc0b6a

    • SHA512

      7627870b3f097cd12257f55e1165f4fd4662adb1a9ce88cb2f4198109e11a9ca7c5c5e76c8a5b9072034fae094e71561d49d3e53f7765b8776c861f3d3a70ed4

    • Ragnarok

      Ransomware family deployed from Citrix servers infected via CVE-2019-19781.

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Modifies boot configuration data using bcdedit

    • Modifies Installed Components in the registry

    • Modifies Windows Firewall

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Modifies service

MITRE ATT&CK Enterprise v6

Tasks