General
-
Target
3dddc43094e3b65f3da251b9abe774029c252456aa6d9614733da74859fa9215
-
Size
1.6MB
-
Sample
221020-mcap2shdd5
-
MD5
0a7194829f99e72104cefc3bc791c1e5
-
SHA1
a1979bb993a079f7f8f23b893690985ca8c04da1
-
SHA256
3dddc43094e3b65f3da251b9abe774029c252456aa6d9614733da74859fa9215
-
SHA512
5f1cbcda731ee17792305cf4f07494f026594ae3b5b4a4026bb4189bf7dc32c939985e5fde29b19a0bba3b1f1e2d9c857bc37199adedfe8c4603a8e325aaacd9
-
SSDEEP
768:spCmKJILjsoq65corBjd/3oqab0k3RLKul1FXI4xyuReduloYQ:splco4aFoqaXpTXISR8YQ
Static task
static1
Behavioral task
behavioral1
Sample
3dddc43094e3b65f3da251b9abe774029c252456aa6d9614733da74859fa9215.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
3dddc43094e3b65f3da251b9abe774029c252456aa6d9614733da74859fa9215.exe
Resource
win10v2004-20220901-en
Malware Config
Extracted
C:\Users\Public\Documents\RGNR_517C3C8B.txt
1BKK8bsFfG3YxTd3N15GxaYfHopoThXoY4
https://tox.chat/download.html
Targets
-
-
Target
3dddc43094e3b65f3da251b9abe774029c252456aa6d9614733da74859fa9215
-
Size
1.6MB
-
MD5
0a7194829f99e72104cefc3bc791c1e5
-
SHA1
a1979bb993a079f7f8f23b893690985ca8c04da1
-
SHA256
3dddc43094e3b65f3da251b9abe774029c252456aa6d9614733da74859fa9215
-
SHA512
5f1cbcda731ee17792305cf4f07494f026594ae3b5b4a4026bb4189bf7dc32c939985e5fde29b19a0bba3b1f1e2d9c857bc37199adedfe8c4603a8e325aaacd9
-
SSDEEP
768:spCmKJILjsoq65corBjd/3oqab0k3RLKul1FXI4xyuReduloYQ:splco4aFoqaXpTXISR8YQ
Score10/10-
RagnarLocker
Ransomware first seen at the end of 2019, which has been used in targetted attacks against multiple companies.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-