General

  • Target

    041fd213326dd5c10a16caf88ff076bb98c68c052284430fba5f601023d39a14

  • Size

    798KB

  • Sample

    201001-lje66h2qlj

  • MD5

    42c1ec152ed11f21f394f1c6982c8036

  • SHA1

    2a85f23e5a21ddaea01a7ada6654c6a7c3bf140f

  • SHA256

    041fd213326dd5c10a16caf88ff076bb98c68c052284430fba5f601023d39a14

  • SHA512

    eb490a26143b018c1ae881095cbf0fafd597454e9c2b72317308fb480be0ee35b84dae3844b640426341132fec9ac746d9a9f051703d4c62657a127064eba95a

Malware Config

Extracted

Path

C:\Users\Public\Documents\RGNR_AC7AABB2.txt

Ransom Note
Hello PSE_CREDIT_UNION ! ***************************************************************************************************************** If you reading this message, then your network was PENETRATED and all of your files and data has been ENCRYPTED by RAGNAR_LOCKER ! ***************************************************************************************************************** *********What happens with your system ?************ Your network was penetrated, all your files and backups was locked! So from now there is NO ONE CAN HELP YOU to get your files back, EXCEPT US. You can google it, there is no CHANCES to decrypt data without our SECRET KEY. But don't worry ! Your files are NOT DAMAGED or LOST, they are just MODIFIED. You can get it BACK as soon as you PAY. We are looking only for MONEY, so there is no interest for us to steel or delete your information, it's just a BUSINESS $-) HOWEVER you can damage your DATA by yourself if you try to DECRYPT by any other software, without OUR SPECIFIC ENCRYPTION KEY !!! Also, all of your sensitive and private information were gathered and if you decide NOT to pay, we will upload it for public view ! **** ***********How to get back your files ?****** To decrypt all your files and data you have to pay for the encryption KEY : BTC wallet for payment: 1E6EjTqYPHLj1uovPKKRXzMpPCcpAcVuiU Amount to pay (in Bitcoin): 60 **** ***********How much time you have to pay?********** * You should get in contact with us within 2 days after you noticed the encryption to get a better price. * The price would be increased by 100% (double price) after 14 Days if there is no contact made. * The key would be completely erased in 21 day if there is no contact made or no deal made. Some sensetive information stolen from the file servers would be uploaded in public or to re-seller. **** ***********What if files can't be restored ?****** To prove that we really can decrypt your data, we will decrypt one of your locked files ! Just send it to us and you will get it back FOR FREE. The price for the decryptor is based on the network size, number of employees, annual revenue. Please feel free to contact us for amount of BTC that should be paid. **** ! IF you don't know how to get bitcoins, we will give you advise how to exchange the money. !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! ! HERE IS THE SIMPLE MANUAL HOW TO GET CONTCAT WITH US ! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! 1) Go to the official website of TOX messenger ( https://tox.chat/download.html ) 2) Download and install qTOX on your PC, choose the platform ( Windows, OS X, Linux, etc. ) 3) Open messenger, click "New Profile" and create profile. 4) Click "Add friends" button and search our contact 7D509C5BB14B1B8CB0A3338EEA9707AD31075868CB9515B17C4C0EC6A0CCCA750CA81606900D 5) For identification, send to our support data from ---RAGNAR SECRET--- IMPORTANT ! IF for some reasons you CAN'T CONTACT us in qTOX, here is our reserve mailbox ( hello_psecu@protonmail.com ) send a message with a data from ---RAGNAR SECRET--- WARNING! -Do not try to decrypt files with any third-party software (it will be damaged permanently) -Do not reinstall your OS, this can lead to complete data loss and files cannot be decrypted. NEVER! -Your SECRET KEY for decryption is on our server, but it will not be stored forever. DO NOT WASTE TIME ! *********************************************************************************** ---RAGNAR SECRET--- MmE2RjY2N2YwNUZlYmRERjNhZGY4MWY0Y0NiMUEwNEIwRkYyQUZhNDE5QjEwNzYzODhGZjE2QWM5ZGFEYzEwYg== ---RAGNAR SECRET--- ***********************************************************************************
Emails

hello_psecu@protonmail.com

Wallets

1E6EjTqYPHLj1uovPKKRXzMpPCcpAcVuiU

URLs

https://tox.chat/download.html

Targets

    • Target

      041fd213326dd5c10a16caf88ff076bb98c68c052284430fba5f601023d39a14

    • Size

      798KB

    • MD5

      42c1ec152ed11f21f394f1c6982c8036

    • SHA1

      2a85f23e5a21ddaea01a7ada6654c6a7c3bf140f

    • SHA256

      041fd213326dd5c10a16caf88ff076bb98c68c052284430fba5f601023d39a14

    • SHA512

      eb490a26143b018c1ae881095cbf0fafd597454e9c2b72317308fb480be0ee35b84dae3844b640426341132fec9ac746d9a9f051703d4c62657a127064eba95a

    • RagnarLocker

      Ransomware first seen at the end of 2019, which has been used in targetted attacks against multiple companies.

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Drops startup file

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

    • Modifies service

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Bootkit

1
T1067

Modify Existing Service

1
T1031

Defense Evasion

File Deletion

2
T1107

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Impact

Inhibit System Recovery

2
T1490

Tasks