Ragnar Locker
MITRE ATT&CK: S0481 View on attack.mitre.org
Aliases: RagnarLocker, Ragnar Locker
- First seen
- 2019-12-01 00:00:00
- Malware type
- ransomware
- Family
- Malware family
- Operating systems
- windows
- Related IoCs
- 12 (11 malicious)
- Last IoC activity
- 2026-08-12 13:18:40
- Profile updated
- 2026-07-07 15:43:32
Targeted industries: energy-and-utilities government-and-public-sector manufacturing transportation-and-logistics
Targeted regions: country_code:us country_code:gb country_code:fr country_code:de
Context
Ragnar Locker is a ransomware that has been in use since at least December 2019.
Recent IoC activity
11 malicious indicators in Maltiverse are attributed to Ragnar Locker (S0481). The 11 most recently updated:
| Type | Indicator | Updated | Sources |
|---|---|---|---|
| file sample | bf4fb693e09c987a63a32ea809b2e928a0f0761339cadcb53ed909e7692e3242 | 2026-08-12 | 1 |
| IP address | 121.148.236.5 | 2026-08-10 | 6 |
| file sample | f668f74d8808f5658153ff3e6aee8653b6324ada70a4aa2034dfa20d96875836 | 2026-07-06 | 1 |
| file sample | 1602d04000a8c7221ed0d97d79f3157303e209d4640d31b8566dd52c2b09d033.bin | 2026-04-30 | 2 |
| file sample | e_win.exe | 2026-04-13 | 1 |
| file sample | ragnar_locker_Omniga.de_ | 2025-10-31 | 1 |
| file sample | sasas.bin | 2025-10-30 | 3 |
| file sample | ragnar_locker_GST_AutoLeather | 2025-10-24 | 1 |
| file sample | 9706a97ffa43a0258571def8912dc2b8bf1ee207676052ad1b9c16ca9953fc2c.exe | 2025-08-31 | 2 |
| URL | http://121.148.236.5/log | 2025-02-12 | 1 |
| URL | http://mykgoj7uvqtgl367.onion/log | 2025-02-12 | 1 |
Detection coverage
- 3 YARA rules
- 368 Sigma rules
Malware & tools used
- Data Encrypted for Impact (attack-pattern)
- Inhibit System Recovery (attack-pattern)
- Disable or Modify Tools (attack-pattern)
- Service Execution (attack-pattern)
- Windows Command Shell (attack-pattern)
- Run Virtual Instance (attack-pattern)
- Service Stop (attack-pattern)
- System Location Discovery (attack-pattern)
- Regsvr32 (attack-pattern)
- Windows Service (attack-pattern)
- Msiexec (attack-pattern)
- Rundll32 (attack-pattern)
- Peripheral Device Discovery (attack-pattern)
Used by threat actors
- FIN8 (threat-actor)
Detection rules
- TRELLIX_ARC_Netwalker (yara-rule)
- SIGNATURE_BASE_MAL_Ransom_Ragnarlocker_July_2020_1 (yara-rule)
- MALPEDIA_Win_Ragnarlocker_Auto (yara-rule)
Related threat objects
- Maze (malware)
Reports & references
- CrowdStrike — Double Trouble Ransomware Data Leak Extortion Part 1 (report)
- analyst1.com — Ransom Mafia Analysis Of The World%E2%80%99S First Ransomware Cartel (report)
- CrowdStrike — Report2021Gtr (report)
- analyst1.com — Ransom Mafia Analysis Of The Worlds First Ransomware Cartel (report)
- accenture.com — Moving Left Ransomware Boom (report)
- docs.google.com — 1Mi8Z2Tbhmqq5X8Wf Ozv3Dvjz5Sjos 3 (report)
- ics-cert.kaspersky.com — Kaspersky H1 2020 Ics Report En (report)
- ke-la.com — How Ransomware Gangs Find New Monetization Schemes And Evolve In Marketing (report)
- news.sophos.com — The Ransomware Threat Intelligence Center (report)
- public.intel471.com — Ransomware As A Service 2020 Ryuk Maze Revil Egregor Doppelpaymer (report)
- Broadcom/Symantec — The Ransomware Threat September 2021 (report)
- accenture.com — Evolving Danger Ransomware Extortion (report)
- cyborgsecurity.com — Hunting Ransomware Inhibiting System Backup Or Recovery (report)
- hornetsecurity.com — Leakware Ransomware Hybrid Attacks (report)
- Microsoft — Ransomware Groups Continue To Target Healthcare Critical Services Heres How To Reduce Risk (report)
- intel471.com — Conti Ransomware Cooperation Maze Lockbit Ragnar Locker (report)
- Kaspersky — 99255 (report)
- Kaspersky — 106824 (report)
- bleepingcomputer.com — Ragnar Locker Ransomware Targets Msp Enterprise Support Tools (report)
- news.sophos.com — Ragnar Locker Ransomware Deploys Virtual Machine To Dodge Security (report)
- cybersecurity-insiders.com — Ransomware Attack Makes Cwt Pay 4 5 Million In Bitcoins To Hackers (report)
- bleepingcomputer.com — Ransomware Gang Threatens To Leak Data If Victim Contacts Fbi Police (report)
- twitter.com — 1475568201673105409 (report)
- trellix.com — Analysis And Protections For Ragnarlocker Ransomware (report)
- reversing.fun — Unpacking Ragnarlocker Via Emulation (report)