内容仅以原始语言提供
class="post-article">
Ransomware C 自2020年起活跃

RagnarLocker

Ragnar Locker is a ransomware group active 2019-2023, dismantled by Europol. PE32 GUI x86 binary with RAGNAR SECRET string confirmed. CryptAcquireContextW+CryptEncrypt for file encryption. GetDriveTypeW+FindFirstFileW/FindNextFileW for drive and file enumeration. OpenProcessToken+DuplicateTokenEx for privilege escalation to SYSTEM. Targets corporate networks across 12+ countries.

威胁档案
类型 Ransomware
编程语言C
C2协议—
首次发现2020
目标 Windows
用途 / 能力
  • VMware ESXi dahil kurumsal şifreleme
尚未发现该家族的 C2 服务器。

研究报告 (3)

Kritik

RagnarLockerRansomware 041fd213 -- RAGNAR SECRET Confirmed CryptEncrypt File Encryption GetDriveTypeW Drive Enumeration OpenProcessToken DuplicateTokenEx Privilege Escalation | Kritik

RagnarLocker 041fd213 PE32 GUI x86 818KB entropy 7.97. RAGNAR SECRET string onay. CryptEncrypt dosya sifreleme. GetDriveTypeW drive enumeration. OpenProcessToken DuplicateTokenEx privilege escalation.

阅读报告 →
Yüksek

RagnarLocker -- alfons Developer, javaw.exe Java Taklidi PDB 58KB Ultra Küçük | Yüksek

RagnarLocker 58KB. C:\Users\alfons\Desktop\javaw.exe PDB. APPDATA alfons gelistirici parmak izi. CryptEncrypt.

阅读报告 →
Kritik

RagnarLocker -- 817KB, .adobe PE Section Imzasi, CryptEncrypt CAPI | Kritik

RagnarLocker 817KB. .adobe PE section imzası. CryptEncrypt CAPI. Teknik VMware ESXi.

阅读报告 →