General
-
Target
60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128
-
Size
200KB
-
Sample
201001-mtmdynx2ae
-
MD5
c2c82616348e40bd2ce31d4c32be4a7e
-
SHA1
2a378a324967be184225d50687a77221fe672595
-
SHA256
60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128
-
SHA512
4b04c8ec077cf568908afb50ff67fbf9051fdd9f797bd969e9bcef43518d6f83e1ac184a860de1f3a3bc52940599f1d81efa8eff2d8cfff09fdc676fc9d331e6
Static task
static1
Behavioral task
behavioral1
Sample
60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
Resource
win7
Behavioral task
behavioral2
Sample
60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
Resource
win10v200722
Malware Config
Extracted
C:\Users\Public\Documents\!$R4GN4R_F0C1BF83$!.txt
ragnarlocker
http://prnt.sc/tz6u6u
http://prnt.sc/tz6uq9
http://prnt.sc/tz6uz9
http://prnt.sc/tz6w7x
http://prnt.sc/tzoumv
http://p6o7m73ujalhgkiv.onion/?J0gYIisP3R7m
http://rgngerzxui2kizq6h5ekefneizmn54n4bcjjthyvdir22orayuya5zad.onion/client/?E5AddcB5e33bF83b3e3e23ef7fD9Dc28eAe4CA0f2D0992AC4d688A35eB5c543F
Targets
-
-
Target
60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128
-
Size
200KB
-
MD5
c2c82616348e40bd2ce31d4c32be4a7e
-
SHA1
2a378a324967be184225d50687a77221fe672595
-
SHA256
60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128
-
SHA512
4b04c8ec077cf568908afb50ff67fbf9051fdd9f797bd969e9bcef43518d6f83e1ac184a860de1f3a3bc52940599f1d81efa8eff2d8cfff09fdc676fc9d331e6
Score10/10-
RagnarLocker
Ransomware first seen at the end of 2019, which has been used in targetted attacks against multiple companies.
-
Modifies boot configuration data using bcdedit
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Modifies service
-