2025-11-09_feab4d702f93d5fa980e273f33efb1cb_elex_ragnar-locker

Sharing

Copy URL Twitter E-mail

General

Target
2025-11-09_feab4d702f93d5fa980e273f33efb1cb_elex_ragnar-locker
Size 60KB
Sample251109-t797qafp21
SHA256 27cae5ef4e82d7130581324a34b7d03b13f7139e49e8ac73e831934b0bd00983
MD5 feab4d702f93d5fa980e273f33efb1cb
SHA1 0cf8c5ecef981557e00de858a1e76fe6e6412ee3
SHA512 88eca972b49d4a2577682aa8cc31dbb554041df3220af0306f5ccea422bd5a48aa9e95c580e4b6fbe8db9a2980ff7f35791bf00d30a395864c7381642bace4f1
SSDEEP 768:8pBsvKMNyoq65co7Bjd/3oqab0k3R2RaXlj+xJ:8pPM4o4qFoqaXS6+H
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2025-11-09_feab4d702f93d5fa980e273f33efb1cb_elex_ragnar-locker

File Explorer

2025-11-09_feab4d702f93d5fa980e273f33efb1cb_elex_ragnar-locker

.exe 60KB

2025-11-09_feab4d702f93d5fa980e273f33efb1cb_elex_ragnar-locker

IMPHASH 839139e8d46f551df7ae96cb6ef00736
SHA256 27cae5ef4e82d7130581324a34b7d03b13f7139e49e8ac73e831934b0bd00983
MD5 feab4d702f93d5fa980e273f33efb1cb
SHA1 0cf8c5ecef981557e00de858a1e76fe6e6412ee3
SHA512 88eca972b49d4a2577682aa8cc31dbb554041df3220af0306f5ccea422bd5a48aa9e95c580e4b6fbe8db9a2980ff7f35791bf00d30a395864c7381642bace4f1
SSDEEP 768:8pBsvKMNyoq65co7Bjd/3oqab0k3R2RaXlj+xJ:8pPM4o4qFoqaXS6+H
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11760

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFilePointerEx FindClose CloseHandle GetNativeSystemInfo GetTickCount MapViewOfFile UnmapViewOfFile lstrcmpiW lstrcpyA lstrcpyW lstrcatW lstrlenA lstrlenW CreateEventW CreateFileMappingW LoadLibraryW CreateProcessW GetStartupInfoW GetCommandLineW GetDriveTypeW GetSystemDirectoryW GetWindowsDirectoryW ReadFile CreateFileW SetFileAttributesW GetFileAttributesW FindFirstFileW FindNextFileW CopyFileW MoveFileExW GetVolumeInformationA GetVolumeInformationW GetComputerNameW FindFirstVolumeA FindNextVolumeA FindVolumeClose SetVolumeMountPointA GetVolumePathNamesForVolumeNameA WTSGetActiveConsoleSessionId MultiByteToWideChar WideCharToMultiByte GetLocaleInfoW CreateToolhelp32Snapshot Process32FirstW Process32NextW DeviceIoControl WriteFile GetFileSize GetFileSizeEx UnlockFile LockFile GetLogicalDrives Sleep WaitForMultipleObjects WaitForSingleObject GetLastError CreateThread TerminateProcess ExitProcess GetCurrentProcess OpenProcess GetProcessHeap HeapFree HeapAlloc VirtualFree VirtualAlloc LocalFree LocalAlloc GetFullPathNameW GetProcAddress

user32

wsprintfA wsprintfW

advapi32

CryptGenRandom CryptReleaseContext QueryServiceStatusEx OpenServiceA OpenSCManagerA EnumServicesStatusA EnumDependentServicesA ControlService CloseServiceHandle CryptEncrypt CryptDestroyKey CryptAcquireContextW RegQueryValueExW RegOpenKeyExW RegCloseKey DuplicateTokenEx CreateProcessAsUserW GetUserNameW SetTokenInformation OpenProcessToken

shell32

SHGetSpecialFolderPathW CommandLineToArgvW

shlwapi

StrStrIA PathFindExtensionW StrToIntA

crypt32

CryptDecodeObjectEx CryptStringToBinaryW CryptBinaryToStringA CryptImportPublicKeyInfo

Name

.text

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

860B

Virtual Size

860B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.keys

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

480B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

800B

Virtual Size

800B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2025-11-09_feab4d702f93d5fa980e273f33efb1cb_elex_ragnar-locker

kernel32

user32

advapi32

shell32

shlwapi

crypt32

generic