General
-
Target
l.exe
-
Size
5.4MB
-
Sample
200923-4ffb1p7b6j
-
MD5
d735552452a4c85c6f7cbacb67bafa38
-
SHA1
94a55c38e34930ac4a11bef628b3678721759179
-
SHA256
4110e5497ebc7f2f587412c08967e815d142494a1027ef235c375d2841bc0b6a
-
SHA512
7627870b3f097cd12257f55e1165f4fd4662adb1a9ce88cb2f4198109e11a9ca7c5c5e76c8a5b9072034fae094e71561d49d3e53f7765b8776c861f3d3a70ed4
Static task
static1
Behavioral task
behavioral1
Sample
l.exe
Resource
win7v200722
Behavioral task
behavioral2
Sample
l.exe
Resource
win10v200722
Malware Config
Extracted
C:\!!ReadMe_To_Decrypt_My_Files.txt
ragnarok
Extracted
C:\!!ReadMe_To_Decrypt_My_Files.txt
ragnarok
Targets
-
-
Target
l.exe
-
Size
5.4MB
-
MD5
d735552452a4c85c6f7cbacb67bafa38
-
SHA1
94a55c38e34930ac4a11bef628b3678721759179
-
SHA256
4110e5497ebc7f2f587412c08967e815d142494a1027ef235c375d2841bc0b6a
-
SHA512
7627870b3f097cd12257f55e1165f4fd4662adb1a9ce88cb2f4198109e11a9ca7c5c5e76c8a5b9072034fae094e71561d49d3e53f7765b8776c861f3d3a70ed4
Score10/10-
Ragnarok
Ransomware family deployed from Citrix servers infected via CVE-2019-19781.
-
Modifies boot configuration data using bcdedit
-
Modifies Installed Components in the registry
-
Modifies Windows Firewall
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Modifies service
-