General
-
Target
0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36
-
Size
798KB
-
Sample
220302-cc9h9sdgbl
-
MD5
987bcd521229b303fbe384def3b9be24
-
SHA1
81606251ea97a89f483a675bc819d545e7ff515a
-
SHA256
0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36
-
SHA512
d8af7542607e2c9aace36accd594ef41c1334010917c64f7dfba806ca795715cfd967963924f732c2d4ebe7c36282bf8f96f6d971265c2a7b4b94c6d259e99b5
Static task
static1
Behavioral task
behavioral1
Sample
0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe
Resource
win7-20220223-en
Behavioral task
behavioral2
Sample
0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe
Resource
win10v2004-en-20220113
Malware Config
Extracted
C:\Users\Public\Documents\RGNR_2BF34AC9.txt
1E6EjTqYPHLj1uovPKKRXzMpPCcpAcVuiU
https://tox.chat/download.html
Targets
-
-
Target
0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36
-
Size
798KB
-
MD5
987bcd521229b303fbe384def3b9be24
-
SHA1
81606251ea97a89f483a675bc819d545e7ff515a
-
SHA256
0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36
-
SHA512
d8af7542607e2c9aace36accd594ef41c1334010917c64f7dfba806ca795715cfd967963924f732c2d4ebe7c36282bf8f96f6d971265c2a7b4b94c6d259e99b5
Score10/10-
RagnarLocker
Ransomware first seen at the end of 2019, which has been used in targetted attacks against multiple companies.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-