General
-
Target
since1969.bin
-
Size
210KB
-
Sample
230919-qceksabb66
-
MD5
48452dd2506831d0b340e45b08799623
-
SHA1
74993759f49d123ec334111f29cdbbf2e0276b58
-
SHA256
b7319f3e21c3941fc2a960b67a150b02f1f3389825164140e75dfa023a73d34c
-
SHA512
5a0b4f5884ae2d302661b0581ab2475c1403555af0f531e1d0c29e240454dfe9979a32979d30856c5ad5da0ea1ffac1ec2c16eb6fa07b7ece74e069fcf2e5958
-
SSDEEP
3072:LNWPHNek0igmpXlZwbvsBQUbtqJQW7xAZ22yz6VoSYMFZoJ8lsPGKLpZnoHq86fa:RGSigm1lmbaBp7O6qSYCiNPhzHa
Static task
static1
Behavioral task
behavioral1
Sample
since1969.exe
Resource
win10v2004-20230915-en
Malware Config
Extracted
C:\Users\Admin\Documents\!!ReadMe_To_Decrypt_My_Files.txt
ragnarok
Targets
-
-
Target
since1969.bin
-
Size
210KB
-
MD5
48452dd2506831d0b340e45b08799623
-
SHA1
74993759f49d123ec334111f29cdbbf2e0276b58
-
SHA256
b7319f3e21c3941fc2a960b67a150b02f1f3389825164140e75dfa023a73d34c
-
SHA512
5a0b4f5884ae2d302661b0581ab2475c1403555af0f531e1d0c29e240454dfe9979a32979d30856c5ad5da0ea1ffac1ec2c16eb6fa07b7ece74e069fcf2e5958
-
SSDEEP
3072:LNWPHNek0igmpXlZwbvsBQUbtqJQW7xAZ22yz6VoSYMFZoJ8lsPGKLpZnoHq86fa:RGSigm1lmbaBp7O6qSYCiNPhzHa
Score10/10-
Ragnarok
Ransomware family deployed from Citrix servers infected via CVE-2019-19781.
-
Modifies boot configuration data using bcdedit
-
Renames multiple (187) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Modifies Windows Firewall
-
Drops desktop.ini file(s)
-