ragnarlocker | d6a956684e7b3dc1e7c420b8ff2f8f3367f68cc5a7c440a8a2d8f78f1a59c859

General

Target
e_win.exe
Size 47KB
Sample260413-tx7c3sfy4s
SHA256 d6a956684e7b3dc1e7c420b8ff2f8f3367f68cc5a7c440a8a2d8f78f1a59c859
MD5 07b509aed6b93bbccef40831b6ba5b91
SHA1 4bf28999ef312ef2b2de24be8b38e88b11b1bc34
SHA512 7ce9c9c81dab21a0b62f56edd0b8b3e72775693ee11b590a361201cf89313c27c86c4e5846426bf64a2e62bae2766f55af098b2ffe78e35eed67e5a58ba13c50
SSDEEP 768:BpBsvKMNyoq65co7Bjd/3oqab0k3R2pXlj+Bnk:BpPM4o4qFoqaXC+6
TLSH
T136235C214697E056E9930874312BBCE9FA7D5A718758EBE3BE001C81287D9F2962C773
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Public\Documents\RGNR_57589CE4.txt

ragnarlocker

Ransom Note

***************************************************************************************************************** HELLO EDP.com ! If you reading this message, then your network was PENETRATED and all of your files and data has been ENCRYPTED by RAGNAR_LOCKER ! ***************************************************************************************************************** !!!!! WARNING !!!!! DO NOT Modify, rename, copy or move any files or you can DAMAGE them and decryption will be impossible. DO NOT use any third party or public decryption software, it also may damage files. DO NOT Shutdown or reset your system ------------------------------------- There is ONLY ONE possible way to get back your files - contact us and pay for our special decryption key ! For your GUARANTEE we will decrypt 2 of your files FOR FREE, as a proof of our capabilities Don't waste your TIME, the link for contacting us will be deleted if there is no contact made in closest future and you will never restore your DATA. HOWEVER if you will contact us within 2 day since get penetrated - you can get a very SPECIAL PRICE. ATTENTION ! We had downloaded more than 10TB of data from your fileservers and if you don't contact us for payment, we will publish it or sell to interested parties. Here is just a small part of your files that we have, for a proof (use Tor Browser for open the link) : http://p6o7m73ujalhgkiv.onion/?p=171 We gathered the most sensitive and confidential information about your transactions, billing, contracts, clients and partners. And be assure that if you wouldn't pay, all files and documents would be publicated for everyones view and also we would notify all your clients and partners about this leakage with direct links. So if you want to avoid such a harm for your reputation, better pay the amount that we asking for. ============================================================================================================== ! HERE IS THE SIMPLE MANUAL HOW TO GET CONTACT WITH US VIA LIVE CHAT ! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! a) Download and install TOR browser from this site : https://torproject.org b) For contact us via LIVE CHAT open our website : http://mykgoj7uvqtgl367.onion/client/?6bECA2b2AFFfBC1Dff0aa0EaaAd468bec0903b5e4Ea58ecde3C264bC55c7389E c) For visit our NEWS PORTAL with your data, open this website : http://p6o7m73ujalhgkiv.onion/?page_id=171 d) If Tor is restricted in your area, use VPN When you open LIVE CHAT website follow rules : Follow the instructions on the website. At the top you will find CHAT tab. Send your message there and wait for response (we are not online 24/7, So you have to wait for your turn). *********************************************************************************** ---RAGNAR SECRET--- NmJFQ0EyYjJBRkZmQkMxRGZmMGFhMEVhYUFkNDY4YmVjMDkwM2I1ZTRFYTU4ZWNkZTNDMjY0YkM1NWM3Mzg5RQ== ---RAGNAR SECRET--- ***********************************************************************************

URLs

http://p6o7m73ujalhgkiv.onion/?p=171
http://mykgoj7uvqtgl367.onion/client/?6bECA2b2AFFfBC1Dff0aa0EaaAd468bec0903b5e4Ea58ecde3C264bC55c7389E
http://p6o7m73ujalhgkiv.onion/?page_id=171

Targets

- Target
  e_win.exe
- Size 47KB
- SHA256 d6a956684e7b3dc1e7c420b8ff2f8f3367f68cc5a7c440a8a2d8f78f1a59c859
- MD5 07b509aed6b93bbccef40831b6ba5b91
- SHA1 4bf28999ef312ef2b2de24be8b38e88b11b1bc34
- SHA512 7ce9c9c81dab21a0b62f56edd0b8b3e72775693ee11b590a361201cf89313c27c86c4e5846426bf64a2e62bae2766f55af098b2ffe78e35eed67e5a58ba13c50
- SSDEEP 768:BpBsvKMNyoq65co7Bjd/3oqab0k3R2pXlj+Bnk:BpPM4o4qFoqaXC+6
- TLSH
  T136235C214697E056E9930874312BBCE9FA7D5A718758EBE3BE001C81287D9F2962C773
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

bootkit defense_evasion discovery execution ragnarlocker impact persistence ransomware credential_access spyware stealer
- Family: RagnarLocker
  Ransomware first seen at the end of 2019, which has been used in targetted attacks against multiple companies.
  ransomware ragnarlocker
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Renames multiple (637) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1 behavioral2