1602d04000a8c7221ed0d97d79f3157303e209d4640d31b8566dd52c2b09d033.bin

Classification: Malicious

1602d04000a8c7221ed0d97d79f3157303e209d4640d31b8566dd52c2b09d033.bin is a malicious file sample. Linked to Ragnar Locker malware.

Detection summary

  • 99 antivirus detections (80% detection ratio)
  • 0 IDS alerts
  • 3 processes observed
  • 0 contacted hosts
  • 0 DNS requests

MITRE ATT&CK associations

Malware families: RAGNAR LOCKER (S0481)

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Generic Malware Cyber Threat Alliance 2026-08-13 10:01:04 2026-08-13 10:01:04 malicious-activity
Generic Malware Hybrid-Analysis 2026-04-04 00:45:08 2026-04-04 00:45:08
Ragnarlocker Triage 2026-04-03 22:07:07 2026-04-03 22:07:07 malicious-activity S0481 Ragnar Locker
Generic.Ransom.Ragnar Hybrid-Analysis 2020-07-07 06:15:12 2020-07-07 06:15:12

Tags

ragnarlocker bootkit credential_access defense_evasion discovery execution impact persistence ransomware spyware stealer

Sample information

Filenames
1602d04000a8c7221ed0d97d79f3157303e209d4640d31b8566dd52c2b09d033.bin, 1602d04000a8c7221ed0d97d79f3157303e209d4640d31b8566dd52c2b09d033.exe, 1602d04000a8c7221ed0d97d79f3157303e209d4640d31b8566dd52c2b09d033
File type
PE32 executable (GUI) Intel 80386, for MS Windows
Size
50176 bytes
MD5
3dabfb99101821ae0e89389a9c9d28a5
SHA-1
72b19c503a642770945355ea0dce96bf9d735f81
SHA-256
1602d04000a8c7221ed0d97d79f3157303e209d4640d31b8566dd52c2b09d033
First indexed
2020-07-07 06:15:12
Last updated
2026-04-30 03:10:01

Antivirus detections

EngineDetection
MicroWorld-eScanGeneric.Ransom.Ragnar.D38CF0B0
CAT-QuickHealTrojanRansom.Agent
Qihoo-360Win32/Trojan.Ransom.b44
ALYacTrojan.Ransom.RagnarLocker
CylanceUnsafe
SangforMalware
K7AntiVirusTrojan ( 0056475b1 )
AlibabaRansom:Win32/Ragnar.d5b9f415
K7GWTrojan ( 0056475b1 )
Cybereasonmalicious.910182
TrendMicroRansom.Win32.RAGNAR.A
SymantecTrojan Horse
ESET-NOD32a variant of Win32/Filecoder.RagnarLocker.A
APEXMalicious
Paloaltogeneric.ml
ClamAVWin.Exploit.CVE_2017_0213-6306933-0
KasperskyHEUR:Trojan-Ransom.Win32.Agent.gen
BitDefenderGeneric.Ransom.Ragnar.D38CF0B0
NANO-AntivirusTrojan.Win32.Encoder.hkgips
ViRobotTrojan.Win32.Z.Ransom.50176.B
Ad-AwareGeneric.Ransom.Ragnar.D38CF0B0
SophosTroj/Ransom-FYN
F-SecureTrojan.TR/Ransom.quwlm
DrWebTrojan.Encoder.31566
VIPRETrojan.Win32.Generic!BT
Invinceaheuristic
McAfee-GW-EditionBehavesLike.Win32.Sivis.ph
Trapminemalicious.moderate.ml.score
FireEyeGeneric.mg.3dabfb99101821ae
EmsisoftGeneric.Ransom.Ragnar.D38CF0B0 (B)
SentinelOneDFI - Malicious PE
CyrenW32/Ransom.IVWZ-0469
JiangminTrojan.Agent.crvv
WebrootW32.Trojan.TR.Ransom.quwlm
AviraTR/Ransom.quwlm
Antiy-AVLTrojan[Ransom]/Win32.Agent
MicrosoftRansom:Win32/Ragnar!MSR
Endgamemalicious (high confidence)
ArcabitGeneric.Ransom.Ragnar.D38CF0B0
ZoneAlarmHEUR:Trojan-Ransom.Win32.Agent.gen
GDataWin32.Trojan-Ransom.Ragnar.A
AhnLab-V3Malware/Win32.Ransom.C4006138
Acronissuspicious
McAfeeRansomware-GWY!3DABFB991018
MAXmalware (ai score=100)
VBA32BScope.Trojan.DelShad
MalwarebytesRansom.Ragnar
PandaTrj/GdSda.A
TrendMicro-HouseCallRansom.Win32.RAGNAR.A
RisingRansom.Ragnar!1.C24D (CLASSIC)
IkarusTrojan-Ransom.Ragnarlocker
eGambitUnsafe.AI_Score_81%
FortinetW32/RagnarLocker.A!tr.ransom
BitDefenderThetaAI:Packer.45DF7EF21F
AVGWin32:RansomX-gen [Ransom]
AvastWin32:RansomX-gen [Ransom]
CrowdStrikewin/malicious_confidence_100% (W)
MaxSecureTrojan.Malware.121218.susgen
AVGWin32:MalwareX-gen [Ransom]
AhnLab-V3Malware/Win.Ransom.R509557
AlibabaRansom:Win32/Ragnarlocker.4a5
Antiy-AVLTrojan[Ransom]/Win32.Ragnar.a
AvastWin32:MalwareX-gen [Ransom]
AviraTR/AD.Nekark.kpiaq
BkavW32.AIDetectMalware
CAT-QuickHealRansom.Ragarlocke.S27546087
CTXexe.ransomware.ragnarlocker
CynetMalicious (score: 100)
DeepInstinctMALICIOUS
Elasticmalicious (high confidence)
F-SecureTrojan.TR/AD.Nekark.kpiaq
GoogleDetected
GridinsoftRansom.Win32.Generic.oa!s1
KasperskyHEUR:Trojan-Ransom.Win32.RagnarLocker.gen
Kingsoftmalware.kb.a.999
LionicTrojan.Win32.RagnarLocker.j!c
MalwarebytesMalware.AI.4165177117
McAfeeDReal Protect-LS!3DABFB991018
MicrosoftRansom:Win32/RagnarLocker.MK!MTB
SangforSuspicious.Win32.Save.a
SentinelOneStatic AI - Malicious PE
SkyhighBehavesLike.Win32.Dropper.ph
SophosTroj/Lothlock-A
SymantecRansom.RagnarLocker
TACHYONRansom/W32.RagnarLocker.50176
TencentMalware.Win32.Gencirc.10bdc061
Trapminemalicious.high.ml.score
TrellixENSRansomware-GWY!3DABFB991018
VBA32BScope.TrojanRansom.RagnarLocker
VIPREGeneric.Ransom.Ragnar.D38CF0B0
VaristW32/ABRansom.IVWZ-0469
ViRobotTrojan.Win32.Ransom.50176.A
XcitiumMalware@#36jxnvadf9dkz
YandexTrojan.Filecoder!T3DUkmlR5yA
ZillyaTrojan.Agent.Win32.1446975
ZoneAlarmTroj/Lothlock-A
alibabacloudRansomware:Win/RagnarLocker.A
huorongRansom/Filecoder.ch
tehtrisGeneric.Malware

Process list

NameCommand line
1602d04000a8c7221ed0d97d79f3157303e209d4640d31b8566dd52c2b09d033.exe
WMIC.exeshadowcopy delete
vssadmin.exevssadmin delete shadows /all /quiet