2025-11-09_9f9d4310d6b80e98792230c3baf405bb_elex_ragnar-locker_rhadamanthys

General

Target
2025-11-09_9f9d4310d6b80e98792230c3baf405bb_elex_ragnar-locker_rhadamanthys
Size 123KB
Sample261017-tkrrvswwas
SHA256 d9b50791c3f76454bc1c3bd2cac9ab2ba93a47304e834fd5ee12e4861096ee7f
MD5 9f9d4310d6b80e98792230c3baf405bb
SHA1 b1dc11ca5a169198ee2bfb4ef9f2aeae0334feff
SHA512 cbd47520294dbe0c082d8fcdbb180074379ccaee0819b710e62f954a4ef27a3b3a2ff9195a36b0f6e4a529c3fe05930f9c3455964a932913a277cacfa2c9c1ec
SSDEEP 1536:SvKSz7JSYOTcZ4+Ir2cJI6A4fS58yqiwUukOb+peFgX+22UdF2yIj6+OYuBf5lfh:JoJSOQr2caLXEQuZb+pGgX52SpjV
TLSH
T127C3D020F683C977D4F241F590DD9F59A7AE7E3447241CC393500E9B2AB41E2BA2E627
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2025-11-09_9f9d4310d6b80e98792230c3baf405bb_elex_ragnar-locker_rhadamanthys

File Explorer

2025-11-09_9f9d4310d6b80e98792230c3baf405bb_elex_ragnar-locker_rhadamanthys

.exe 123KB

2025-11-09_9f9d4310d6b80e98792230c3baf405bb_elex_ragnar-locker_rhadamanthys

IMPHASH 489a2424d7a14a26bfcfb006de3cd226
SHA256 d9b50791c3f76454bc1c3bd2cac9ab2ba93a47304e834fd5ee12e4861096ee7f
MD5 9f9d4310d6b80e98792230c3baf405bb
SHA1 b1dc11ca5a169198ee2bfb4ef9f2aeae0334feff
SHA512 cbd47520294dbe0c082d8fcdbb180074379ccaee0819b710e62f954a4ef27a3b3a2ff9195a36b0f6e4a529c3fe05930f9c3455964a932913a277cacfa2c9c1ec
SSDEEP 1536:SvKSz7JSYOTcZ4+Ir2cJI6A4fS58yqiwUukOb+peFgX+22UdF2yIj6+OYuBf5lfh:JoJSOQr2caLXEQuZb+pGgX52SpjV
TLSH
T127C3D020F683C977D4F241F590DD9F59A7AE7E3447241CC393500E9B2AB41E2BA2E627
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

19900

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetModuleHandleW VirtualAllocEx GetACP GetEnvironmentStringsW GetOEMCP GetTickCount CreateEventA GetProcAddress GetCommandLineA LoadLibraryW GetLastError DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSectionAndSpinCount GetCurrentProcess GetProcessHeap InterlockedIncrement lstrlenA GetVersionExA GetVersionExW GetModuleHandleA CompareStringW CompareStringA LCMapStringW GetStartupInfoW GetVersion ExitProcess TerminateProcess UnhandledExceptionFilter GetModuleFileNameW FreeEnvironmentStringsA MultiByteToWideChar FreeEnvironmentStringsW GetEnvironmentStrings GetCommandLineW SetHandleCount GetStdHandle GetFileType GetStartupInfoA GetCurrentThreadId TlsSetValue TlsAlloc TlsFree SetLastError TlsGetValue GetCurrentThread HeapDestroy HeapCreate VirtualFree HeapFree RtlUnwind WriteFile GetModuleFileNameA SetFilePointer InterlockedDecrement WideCharToMultiByte InitializeCriticalSection FatalAppExitA HeapAlloc VirtualAlloc HeapReAlloc IsBadWritePtr LoadLibraryA SetStdHandle Sleep FlushFileBuffers GetCPInfo IsValidLocale IsValidCodePage GetLocaleInfoA EnumSystemLocalesA GetUserDefaultLCID CloseHandle GetStringTypeA GetStringTypeW GetTimeZoneInformation GetLocaleInfoW LCMapStringA SetEnvironmentVariableA

user32

LoadCursorFromFileA CharUpperW

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

2025-11-09_9f9d4310d6b80e98792230c3baf405bb_elex_ragnar-locker_rhadamanthys

kernel32

user32

generic