ragnar_locker_GST_AutoLeather
Classification: Malicious
ragnar_locker_GST_AutoLeather is a malicious file sample. Linked to Ragnar Locker malware. Reported by 2 threat sources, last seen 2026-08-26.
Detection summary
- 61 antivirus detections
- 0 IDS alerts
- 0 processes observed
- 0 contacted hosts
- 0 DNS requests
MITRE ATT&CK associations
Malware families: RAGNAR LOCKER (S0481)
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| Generic Malware | Cyber Threat Alliance | 2026-08-13 10:19:14 | 2026-08-26 10:17:15 | malicious-activity | |
| RagnarLocker | Abuse.ch | 2020-08-03 10:00:55 | 2020-08-03 10:00:55 | S0481 Ragnar Locker |
Sample information
- Filenames
- ragnar_locker_GST_AutoLeather
- File type
- application/x-dosexec
- MD5
1ee5456c1226affd7b72bcdf3db443b7- SHA-1
e22344a92c91b567a6cba7eb66686c438d479462- SHA-256
dd5d4cf9422b6e4514d49a3ec542cffb682be8a24079010cda689afbb44ac0f4- First indexed
- 2020-08-03 11:15:08
- Last updated
- 2025-10-24 07:53:20
Antivirus detections
| Engine | Detection |
|---|---|
| Bkav | W32.AIDetectVM.malwareA |
| MicroWorld-eScan | Generic.Ransom.Ragnar.D9471B0A |
| FireEye | Generic.mg.1ee5456c1226affd |
| CAT-QuickHeal | TrojanRansom.Agent |
| ALYac | Trojan.Ransom.RagnarLocker |
| Cylance | Unsafe |
| Zillya | Trojan.Filecoder.Win32.13900 |
| Sangfor | Malware |
| CrowdStrike | win/malicious_confidence_100% (W) |
| Alibaba | Ransom:Win32/Ragnar.a5bd5cd1 |
| K7GW | Trojan ( 005623661 ) |
| K7AntiVirus | Trojan ( 005623661 ) |
| Arcabit | Generic.Ransom.Ragnar.D9471B0A |
| Invincea | heuristic |
| BitDefenderTheta | AI:Packer.AC42A3161F |
| F-Prot | W32/Filecoder.AA.gen!Eldorado |
| Symantec | W97M.Downloader |
| APEX | Malicious |
| Avast | Win32:RansomX-gen [Ransom] |
| ClamAV | Win.Exploit.CVE_2017_0213-6306933-0 |
| Kaspersky | HEUR:Trojan-Ransom.Win32.Agent.gen |
| BitDefender | Generic.Ransom.Ragnar.D9471B0A |
| NANO-Antivirus | Trojan.Win32.Encoder.hjcznz |
| Paloalto | generic.ml |
| Rising | Ransom.Ragnar!1.C24D (CLOUD) |
| Ad-Aware | Generic.Ransom.Ragnar.D9471B0A |
| Sophos | Troj/Lothlock-A |
| F-Secure | Trojan.TR/AD.RansomHeur.zrgli |
| DrWeb | Trojan.Encoder.31566 |
| VIPRE | Trojan.Win32.Generic!BT |
| TrendMicro | Ransom_Ragnar.R002C0DDK20 |
| McAfee-GW-Edition | BehavesLike.Win32.Generic.ph |
| Fortinet | W32/Filecoder_RagnarLocker.A!tr.ransom |
| Trapmine | malicious.moderate.ml.score |
| Emsisoft | Generic.Ransom.Ragnar.D9471B0A (B) |
| SentinelOne | DFI - Malicious PE |
| Cyren | W32/Filecoder.AA.gen!Eldorado |
| Jiangmin | Trojan.Agent.cqsh |
| eGambit | Unsafe.AI_Score_54% |
| Avira | TR/AD.RansomHeur.zrgli |
| MAX | malware (ai score=100) |
| Antiy-AVL | Trojan[Ransom]/Win32.Agent |
| Endgame | malicious (high confidence) |
| Microsoft | Ransom:Win32/Ragnar!MSR |
| ZoneAlarm | HEUR:Trojan-Ransom.Win32.Agent.gen |
| Cynet | Malicious (score: 100) |
| AhnLab-V3 | Malware/Win32.Ransom.C4006138 |
| McAfee | Ransomware-GWY!1EE5456C1226 |
| VBA32 | BScope.Trojan.DelShad |
| Malwarebytes | Ransom.Ragnar |
| ESET-NOD32 | a variant of Win32/Filecoder.RagnarLocker.A |
| TrendMicro-HouseCall | Ransom.Win32.RAGNAR.SMA |
| Tencent | Win32.Trojan.Filecoder.Edon |
| Yandex | Trojan.Filecoder!dXIa+gczJTI |
| Ikarus | Trojan-Ransom.Ragnarlocker |
| MaxSecure | Trojan.Malware.121218.susgen |
| GData | Win32.Trojan-Ransom.Ragnar.A |
| Webroot | W32.Ransom.Ragnar |
| AVG | Win32:RansomX-gen [Ransom] |
| Panda | Trj/GdSda.A |
| Qihoo-360 | Win32/Trojan.Ransom.b44 |