Rewterz Threat Alert – RagnarLocker Ransomware – IOCs

Severity

Medium

Analysis Summary

A Ragnar Locker ransomware campaign is seen after months, since it hit the energy giant EDP for $10.9M back in April. Once it successfully encrypts the files of a target system, the threat actor operating the RagnarLocker ransomware threatens the compromised company with data leakage if a ransom amount is not paid. The group threatens: “we will publish this Leak in Huge and famous journals and blogs, also we will notify all your clients, partners and competitors. So it’s depend on you make it confidential or public !” According to the ransom note dropped on the EDP encrypted systems, the attackers were able to steal confidential information on billing, contracts, transactions, clients, and partners. Below is their sample ransom note:

The Ragnar Locker operators target software regularly used by managed service providers to prevent their attack from being detected and blocked. After reconnaissance and pre-deployment stages, the attackers drop a highly targeted ransomware executable that adds specific extension to encrypted files, features an embedded RSA-2048 key, and drops custom ransom notes. The ransom notes include the victim’s company name, a link to the Tor site, and the data leak site with the victim’s published data. Like the last time, the targets of this attack appear to be Portuguese. 

Impact

• System Takeover
• Files Encryption
• Confidentiality breach
• Data exposure

Indicators of Compromise

MD5

• cf0a78562c103831dfe6eca6bec99cb9
• e03bb74167a5349f96ff88e5f0ed94f3
• 61a9b3b5320cb4d06155542a25868194
• 73cb5a82f9a2913efd3139f25d86d40e

SHA-256

• 6264e1b62b9fe6662a9fc2a131f316547c9ed0c3684e51423a3e25f09c238d55
• 390eda84632720eb71c5f1d1c0b05ac280a4f67364745a9491476a6d0d9c113b
• 828f247bfa33757043c29ef4379109368f5e6263248436fbf9b9240fd3fe2ebf
• a30bea3ba2c697013bbda0140e5d42dc1d51304055d81eee26d2be7a2d05483d

SHA1

• 588c10739ef20be93cb8f0b2de90d23027fbf281
• 7a99c3d4e361c97dc2c27e077c4c55e5c47cbe36
• 83f117bb1cceff7837933a070c5b917f42539b11
• 247666c54e346782b4c7822135441154e092a76a

Source IP

• 94[.]237[.]109[.]49

Remediation

• Block the threat indicators at their respective controls.
• Only buy licensed and well reputed products.
• Keep all software updated to latest versions.
• Maintain offline backups for files.
• Minimize internet exposure of critical assets storing confidential data.