General
-
Target
6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8
-
Size
116KB
-
Sample
201107-l519w82m22
-
MD5
8f6ba0f6712b0c5a6ad9c3663883e5cd
-
SHA1
ca0a98de71a2014e584dcb6a2b40d7a8a866a008
-
SHA256
6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8
-
SHA512
e7aed7cfedf3e29add6fc2bdd1069c04670030ee29e64c527e5bc75c3eb84b09a7f9182621132aa0cb244683bb9bd71f4a2b1c9e2d6b5fd2d52c311a432503d3
Static task
static1
Behavioral task
behavioral1
Sample
6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
Resource
win10v20201028
Malware Config
Extracted
C:\Users\Public\Documents\RGNR_271FEB00.txt
ragnarlocker
http://p6o7m73ujalhgkiv.onion/?p=171
http://mykgoj7uvqtgl367.onion/client/?6bECA2b2AFFfBC1Dff0aa0EaaAd468bec0903b5e4Ea58ecde3C264bC55c7389E
http://p6o7m73ujalhgkiv.onion/?page_id=171
Targets
-
-
Target
6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8
-
Size
116KB
-
MD5
8f6ba0f6712b0c5a6ad9c3663883e5cd
-
SHA1
ca0a98de71a2014e584dcb6a2b40d7a8a866a008
-
SHA256
6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8
-
SHA512
e7aed7cfedf3e29add6fc2bdd1069c04670030ee29e64c527e5bc75c3eb84b09a7f9182621132aa0cb244683bb9bd71f4a2b1c9e2d6b5fd2d52c311a432503d3
Score10/10-
RagnarLocker
Ransomware first seen at the end of 2019, which has been used in targetted attacks against multiple companies.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Modifies service
-