General
-
Target
0766beb30c575fc68d1ca134bd53c086d2ce63b040e4d0bbd6d89d8c26ca04f6
-
Size
204KB
-
Sample
250311-2ywa7syzdw
-
MD5
fcd9a9e76d99cf8b85a817eee770a333
-
SHA1
1a7a938bb4b88c9a840c0f2935663d3a207c3f26
-
SHA256
0766beb30c575fc68d1ca134bd53c086d2ce63b040e4d0bbd6d89d8c26ca04f6
-
SHA512
ae1c9536e717efebd175ba6cd820740a007c0b31bdcff94aab6b55f940aee4e2406a1e1d6a83ca410ff0018ea049b856a3dc914c49faa3cf74b9e557faab58e5
-
SSDEEP
3072:4QmiWfzjg59RO910Ztfb5ox1wzytOQ9XCYcQIicBT1qk1BD:3WuRfSxazy7XCYcQEbP
Static task
static1
Behavioral task
behavioral1
Sample
0766beb30c575fc68d1ca134bd53c086d2ce63b040e4d0bbd6d89d8c26ca04f6.exe
Resource
win10ltsc2021-20250217-en
Malware Config
Extracted
C:\Users\Public\Documents\!!!_READ_ME_A4B03524_!!!.txt
ragnarlocker
https://prnt.sc/v36ygd
https://prnt.sc/v37089
https://prnt.sc/v36yxt
https://prnt.sc/v36zio
https://prnt.sc/v36xi8
https://prnt.sc/v370oi
http://p6o7m73ujalhgkiv.onion/?38KP4j2zYlWcWRm6zsLg
http://rgnar43spcnsocswaw22lmk7jnget5f6vow7kqmnf4jc6hfwpiwoajid.onion/client/?384fAE1DDC9DE3D3b670f7961AEEAA6DBDaCfb972D6Fff48Baf0bcc6c1da2FAc
http://p6o7m73ujalhgkiv.onion/?http://p6o7m73ujalhgkiv.onion/?38KP4j2zYlWcWRm6zsLg
Targets
-
-
Target
0766beb30c575fc68d1ca134bd53c086d2ce63b040e4d0bbd6d89d8c26ca04f6
-
Size
204KB
-
MD5
fcd9a9e76d99cf8b85a817eee770a333
-
SHA1
1a7a938bb4b88c9a840c0f2935663d3a207c3f26
-
SHA256
0766beb30c575fc68d1ca134bd53c086d2ce63b040e4d0bbd6d89d8c26ca04f6
-
SHA512
ae1c9536e717efebd175ba6cd820740a007c0b31bdcff94aab6b55f940aee4e2406a1e1d6a83ca410ff0018ea049b856a3dc914c49faa3cf74b9e557faab58e5
-
SSDEEP
3072:4QmiWfzjg59RO910Ztfb5ox1wzytOQ9XCYcQIicBT1qk1BD:3WuRfSxazy7XCYcQEbP
-
RagnarLocker
Ransomware first seen at the end of 2019, which has been used in targetted attacks against multiple companies.
-
Ragnarlocker family
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit
-
Renames multiple (4629) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-