General
-
Target
30dcc7a8ae98e52ee5547379048ca1fc90925e09a2a81c055021ba225c1d064c.sample
-
Size
116KB
-
Sample
210726-hknbtmjkvj
-
MD5
63241a7a39692f90328a72c0e9826afd
-
SHA1
016ef5b9e91eb9a90af39dbb2c66fe527de12f92
-
SHA256
30dcc7a8ae98e52ee5547379048ca1fc90925e09a2a81c055021ba225c1d064c
-
SHA512
6a758b525c665c45770b18d84f2cb8a38b45d8093558bf15f5e7f53283c0352bd9afd54cfdac21e3deaf146fb840ba5ba32b9da765902f36ef7aa126cc8287c1
Static task
static1
Behavioral task
behavioral1
Sample
30dcc7a8ae98e52ee5547379048ca1fc90925e09a2a81c055021ba225c1d064c.sample.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
30dcc7a8ae98e52ee5547379048ca1fc90925e09a2a81c055021ba225c1d064c.sample.exe
Resource
win10v20210410
Malware Config
Extracted
C:\Users\Public\Documents\RGNR_F540D252.txt
ragnarlocker
http://p6o7m73ujalhgkiv.onion/?p=171
http://mykgoj7uvqtgl367.onion/client/?6bECA2b2AFFfBC1Dff0aa0EaaAd468bec0903b5e4Ea58ecde3C264bC55c7389E
http://p6o7m73ujalhgkiv.onion/?page_id=171
Targets
-
-
Target
30dcc7a8ae98e52ee5547379048ca1fc90925e09a2a81c055021ba225c1d064c.sample
-
Size
116KB
-
MD5
63241a7a39692f90328a72c0e9826afd
-
SHA1
016ef5b9e91eb9a90af39dbb2c66fe527de12f92
-
SHA256
30dcc7a8ae98e52ee5547379048ca1fc90925e09a2a81c055021ba225c1d064c
-
SHA512
6a758b525c665c45770b18d84f2cb8a38b45d8093558bf15f5e7f53283c0352bd9afd54cfdac21e3deaf146fb840ba5ba32b9da765902f36ef7aa126cc8287c1
Score10/10-
RagnarLocker
Ransomware first seen at the end of 2019, which has been used in targetted attacks against multiple companies.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-