General
-
Target
c2bd70495630ed8279de0713a010e5e55f3da29323b59ef71401b12942ba52f6.sample
-
Size
47KB
-
Sample
210726-vhhhalgwra
-
MD5
f7c48ee1f3ee1b18d255ad98703a5896
-
SHA1
7c3a082237504d3bf36e47b986e02e014a2b8abc
-
SHA256
c2bd70495630ed8279de0713a010e5e55f3da29323b59ef71401b12942ba52f6
-
SHA512
5d5dd72488555f937aa23e674b69a0fc1eaeda38f66450858f3e9b8fe55160a02ece08ed4b6475a62810ebd24b2e2d83ae08ebf2df54b39c174f05027bb608ce
Static task
static1
Behavioral task
behavioral1
Sample
c2bd70495630ed8279de0713a010e5e55f3da29323b59ef71401b12942ba52f6.sample.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
c2bd70495630ed8279de0713a010e5e55f3da29323b59ef71401b12942ba52f6.sample.exe
Resource
win10v20210408
Malware Config
Extracted
C:\Users\Public\Documents\RGNR_3CA64D43.txt
ragnarlocker
http://p6o7m73ujalhgkiv.onion/?p=171
http://mykgoj7uvqtgl367.onion/client/?6bECA2b2AFFfBC1Dff0aa0EaaAd468bec0903b5e4Ea58ecde3C264bC55c7389E
http://p6o7m73ujalhgkiv.onion/?page_id=171
Targets
-
-
Target
c2bd70495630ed8279de0713a010e5e55f3da29323b59ef71401b12942ba52f6.sample
-
Size
47KB
-
MD5
f7c48ee1f3ee1b18d255ad98703a5896
-
SHA1
7c3a082237504d3bf36e47b986e02e014a2b8abc
-
SHA256
c2bd70495630ed8279de0713a010e5e55f3da29323b59ef71401b12942ba52f6
-
SHA512
5d5dd72488555f937aa23e674b69a0fc1eaeda38f66450858f3e9b8fe55160a02ece08ed4b6475a62810ebd24b2e2d83ae08ebf2df54b39c174f05027bb608ce
Score10/10-
RagnarLocker
Ransomware first seen at the end of 2019, which has been used in targetted attacks against multiple companies.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-