General
-
Target
dd5d4cf9422b6e4514d49a3ec542cffb682be8a24079010cda689afbb44ac0f4.sample
-
Size
48KB
-
Sample
210726-kx79bd8zan
-
MD5
1ee5456c1226affd7b72bcdf3db443b7
-
SHA1
e22344a92c91b567a6cba7eb66686c438d479462
-
SHA256
dd5d4cf9422b6e4514d49a3ec542cffb682be8a24079010cda689afbb44ac0f4
-
SHA512
326e647615cab28c2a9e065ad628059b739d207a319c6631f9ed57a97548c67565c096d7227a6dc880484b65013977e95dd25e3ec8258c5e43c4567f0d86af00
Static task
static1
Behavioral task
behavioral1
Sample
dd5d4cf9422b6e4514d49a3ec542cffb682be8a24079010cda689afbb44ac0f4.sample.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
dd5d4cf9422b6e4514d49a3ec542cffb682be8a24079010cda689afbb44ac0f4.sample.exe
Resource
win10v20210408
Malware Config
Extracted
C:\Users\Public\Documents\RGNR_3CA64D43.txt
ragnarlocker
https://prnt.sc/s1xrct
https://prnt.sc/s1xrpe
https://prnt.sc/s1xs5s
https://prnt.sc/s1xt9j
http://p6o7m73ujalhgkiv.onion/in-project-temporarypage-18-04/
http://stppd5as5x4hxs45.onion/client/?1cdCAFdD70D2Eb1E078BCDED49fAb75d6315592715f319aFcb3c6106eFda88a2
Targets
-
-
Target
dd5d4cf9422b6e4514d49a3ec542cffb682be8a24079010cda689afbb44ac0f4.sample
-
Size
48KB
-
MD5
1ee5456c1226affd7b72bcdf3db443b7
-
SHA1
e22344a92c91b567a6cba7eb66686c438d479462
-
SHA256
dd5d4cf9422b6e4514d49a3ec542cffb682be8a24079010cda689afbb44ac0f4
-
SHA512
326e647615cab28c2a9e065ad628059b739d207a319c6631f9ed57a97548c67565c096d7227a6dc880484b65013977e95dd25e3ec8258c5e43c4567f0d86af00
Score10/10-
RagnarLocker
Ransomware first seen at the end of 2019, which has been used in targetted attacks against multiple companies.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-