General
- Target Ragnarok-Prime-Setup.exe
- Size 165.1MB
- Sample260820-bbj2jsxcmg
- SHA256 9fc194604dd860a861e4ebe8d2f09be2749e68b833e6567ed18ac199793646ee
Score
10/10
Malware Config
Targets
-
- Target Ragnarok-Prime-Setup.exe
- Size 165.1MB
- SHA256 9fc194604dd860a861e4ebe8d2f09be2749e68b833e6567ed18ac199793646ee
Score10/10-
Suspicious use of NtCreateProcessExOtherParentProcess
-
Renames multiple (61) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Network Service Discovery
Attempt to gather information on host's network.