Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
1.exe
-
Size
204KB
-
Sample
220826-rrb9msefc5
-
MD5
21a05f8f6f5402757c74e0c4b7e40786
-
SHA1
1e9d519b601b39dc76a8e0a2da50c6ba6978d58d
-
SHA256
1318f8a4566a50537f579d24fd1aabcf7e22e89bc75ffd13b3088fc6e80e9a2a
-
SHA512
e3352cca7728fea90a0be4c4326aa42e684dda66f16d3c0c91f92464b6aa2fda0c9385d4ec6b21d18073a127b8f1cf0d071151675e7fd47154198bf1bddc9e58
-
SSDEEP
1536:dvKSz7JSYOTcZ4+Ir2cJI6A4fS58yqiwUxkOceFgX+22UdF2yIj6+OYuBf5lfEDX:0oJSOQr2caLXEQxZcGgX52SpjVsuWtR
Behavioral task
behavioral1
Sample
1.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
C:\Users\Public\Documents\RGNR_AFD5DBDC.txt
ragnarlocker
http://p6o7m73ujalhgkiv.onion/?p=171
http://mykgoj7uvqtgl367.onion/client/?6bECA2b2AFFfBC1Dff0aa0EaaAd468bec0903b5e4Ea58ecde3C264bC55c7389E
http://p6o7m73ujalhgkiv.onion/?page_id=171
Targets
-
-
Target
1.exe
-
Size
204KB
-
MD5
21a05f8f6f5402757c74e0c4b7e40786
-
SHA1
1e9d519b601b39dc76a8e0a2da50c6ba6978d58d
-
SHA256
1318f8a4566a50537f579d24fd1aabcf7e22e89bc75ffd13b3088fc6e80e9a2a
-
SHA512
e3352cca7728fea90a0be4c4326aa42e684dda66f16d3c0c91f92464b6aa2fda0c9385d4ec6b21d18073a127b8f1cf0d071151675e7fd47154198bf1bddc9e58
-
SSDEEP
1536:dvKSz7JSYOTcZ4+Ir2cJI6A4fS58yqiwUxkOceFgX+22UdF2yIj6+OYuBf5lfEDX:0oJSOQr2caLXEQxZcGgX52SpjVsuWtR
Score10/10-
RagnarLocker
Ransomware first seen at the end of 2019, which has been used in targetted attacks against multiple companies.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-