SYMBOLCOMMON_NAMEaka. SYNONYMS
win.ragnarok (Back to overview)

Ragnarok

VTCollection    

According to Bleeping Computer, the ransomware is used in targeted attacks against unpatched Citrix servers. It excludes Russian and Chinese targets using the system's Language ID for filtering. It also tries to disable Windows Defender and has a number of UNIX filepath references in its strings. Encryption method is AES using a dynamically generated key, then bundling this key up via RSA.

References
2022-06-23 ⋅ Kaspersky ⋅ Danila Nasonov, Natalya Shornikova, Nikita Nazarov, Vasily Davydov, Vladislav Burtsev
The hateful eight: Kaspersky’s guide to modern ransomware groups’ TTPs
Conti Hive BlackByte BlackCat Clop LockBit Mespinoza Ragnarok
2022-03-17 ⋅ Sophos ⋅ Tilly Travers
The Ransomware Threat Intelligence Center
ATOMSILO Avaddon AvosLocker BlackKingdom Ransomware BlackMatter Conti Cring DarkSide dearcry Dharma Egregor Entropy Epsilon Red Gandcrab Karma LockBit LockFile Mailto Maze Nefilim RagnarLocker Ragnarok REvil RobinHood Ryuk SamSam Snatch WannaCryptor WastedLocker
2021-08-26 ⋅ Bleeping Computer ⋅ Ionut Ilascu
Ragnarok ransomware releases master decryptor after shutdown
Ragnarok
2021-05-10 ⋅ DarkTracer ⋅ DarkTracer
Intelligence Report on Ransomware Gangs on the DarkWeb: List of victim organizations attacked by ransomware gangs released on the DarkWeb
RansomEXX Avaddon Babuk Clop Conti Cuba DarkSide DoppelPaymer Egregor Hades LockBit Mailto Maze MedusaLocker Mespinoza Mount Locker Nefilim Nemty Pay2Key PwndLocker RagnarLocker Ragnarok RansomEXX REvil Sekhmet SunCrypt ThunderX
2021-02-23 ⋅ CrowdStrike ⋅ CrowdStrike
2021 Global Threat Report
RansomEXX Amadey Anchor Avaddon BazarBackdoor Clop Cobalt Strike Conti Cutwail DanaBot DarkSide DoppelPaymer Dridex Egregor Emotet Hakbit IcedID JSOutProx KerrDown LockBit Mailto Maze MedusaLocker Mespinoza Mount Locker NedDnLoader Nemty Pay2Key PlugX Pushdo PwndLocker PyXie QakBot Quasar RAT RagnarLocker Ragnarok RansomEXX REvil Ryuk Sekhmet ShadowPad SmokeLoader Snake SUNBURST SunCrypt TEARDROP TrickBot WastedLocker Winnti Zloader Evilnum OUTLAW SPIDER RIDDLE SPIDER SOLAR SPIDER VIKING SPIDER
2020-05-21 ⋅ Sophos ⋅ SophosLabs Uncut
Asnarök attackers twice modified attack midstream
NOTROBIN Ragnarok
2020-05-04 ⋅ blackarrow ⋅ Borja Merino
Ragnarok Stopper: development of a vaccine
Ragnarok
2020-01-28 ⋅ Bleeping Computer ⋅ Lawrence Abrams
Ragnarok Ransomware Targets Citrix ADC, Disables Windows Defender
Ragnarok
2020-01-25 ⋅ Github (k-vitali) ⋅ Vitali Kremez
Extracted Config for Ragnarok Ransomware
Ragnarok
Yara Rules
[TLP:WHITE] win_ragnarok_auto (20260917 | Detects win.ragnarok.)
rule win_ragnarok_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.ragnarok."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ragnarok"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 8bc1 888c0dfcfeffff 99 f7fe 8a8415fcfdffff 88840dfcfcffff 41 }
            // n = 7, score = 200
            //   8bc1                 | mov                 eax, ecx
            //   888c0dfcfeffff       | mov                 byte ptr [ebp + ecx - 0x104], cl
            //   99                   | cdq                 
            //   f7fe                 | idiv                esi
            //   8a8415fcfdffff       | mov                 al, byte ptr [ebp + edx - 0x204]
            //   88840dfcfcffff       | mov                 byte ptr [ebp + ecx - 0x304], al
            //   41                   | inc                 ecx

        $sequence_1 = { 8a8090914200 8841fc 83ea01 75ec 43 836df801 75d5 }
            // n = 7, score = 200
            //   8a8090914200         | mov                 al, byte ptr [eax + 0x429190]
            //   8841fc               | mov                 byte ptr [ecx - 4], al
            //   83ea01               | sub                 edx, 1
            //   75ec                 | jne                 0xffffffee
            //   43                   | inc                 ebx
            //   836df801             | sub                 dword ptr [ebp - 8], 1
            //   75d5                 | jne                 0xffffffd7

        $sequence_2 = { 895d10 0fb691104b4300 8bcb c1e910 0fb6c9 }
            // n = 5, score = 200
            //   895d10               | mov                 dword ptr [ebp + 0x10], ebx
            //   0fb691104b4300       | movzx               edx, byte ptr [ecx + 0x434b10]
            //   8bcb                 | mov                 ecx, ebx
            //   c1e910               | shr                 ecx, 0x10
            //   0fb6c9               | movzx               ecx, cl

        $sequence_3 = { 23ca 8bd3 338decfeffff 03f9 0b95e8feffff 03b87cc14200 03bc0500ffffff }
            // n = 7, score = 200
            //   23ca                 | and                 ecx, edx
            //   8bd3                 | mov                 edx, ebx
            //   338decfeffff         | xor                 ecx, dword ptr [ebp - 0x114]
            //   03f9                 | add                 edi, ecx
            //   0b95e8feffff         | or                  edx, dword ptr [ebp - 0x118]
            //   03b87cc14200         | add                 edi, dword ptr [eax + 0x42c17c]
            //   03bc0500ffffff       | add                 edi, dword ptr [ebp + eax - 0x100]

        $sequence_4 = { 8855ff 83e900 7465 83e901 743d 83e901 }
            // n = 6, score = 200
            //   8855ff               | mov                 byte ptr [ebp - 1], dl
            //   83e900               | sub                 ecx, 0
            //   7465                 | je                  0x67
            //   83e901               | sub                 ecx, 1
            //   743d                 | je                  0x3f
            //   83e901               | sub                 ecx, 1

        $sequence_5 = { 03d9 13f8 8b8538fdffff 031cc580af4200 133cc584af4200 039cc5a4fdffff }
            // n = 6, score = 200
            //   03d9                 | add                 ebx, ecx
            //   13f8                 | adc                 edi, eax
            //   8b8538fdffff         | mov                 eax, dword ptr [ebp - 0x2c8]
            //   031cc580af4200       | add                 ebx, dword ptr [eax*8 + 0x42af80]
            //   133cc584af4200       | adc                 edi, dword ptr [eax*8 + 0x42af84]
            //   039cc5a4fdffff       | add                 ebx, dword ptr [ebp + eax*8 - 0x25c]

        $sequence_6 = { 85f6 7433 6a00 56 ff95c4feffff 56 ff95c8feffff }
            // n = 7, score = 200
            //   85f6                 | test                esi, esi
            //   7433                 | je                  0x35
            //   6a00                 | push                0
            //   56                   | push                esi
            //   ff95c4feffff         | call                dword ptr [ebp - 0x13c]
            //   56                   | push                esi
            //   ff95c8feffff         | call                dword ptr [ebp - 0x138]

        $sequence_7 = { 0fb689104b4300 33f9 c1e708 8b4dfc c1e908 0fb6c9 0fb689104b4300 }
            // n = 7, score = 200
            //   0fb689104b4300       | movzx               ecx, byte ptr [ecx + 0x434b10]
            //   33f9                 | xor                 edi, ecx
            //   c1e708               | shl                 edi, 8
            //   8b4dfc               | mov                 ecx, dword ptr [ebp - 4]
            //   c1e908               | shr                 ecx, 8
            //   0fb6c9               | movzx               ecx, cl
            //   0fb689104b4300       | movzx               ecx, byte ptr [ecx + 0x434b10]

        $sequence_8 = { 51 ff35???????? ffd3 6a17 ff35???????? 8bf0 e8???????? }
            // n = 7, score = 200
            //   51                   | push                ecx
            //   ff35????????         |                     
            //   ffd3                 | call                ebx
            //   6a17                 | push                0x17
            //   ff35????????         |                     
            //   8bf0                 | mov                 esi, eax
            //   e8????????           |                     

        $sequence_9 = { 57 8b7d0c 8d347d01000000 56 e8???????? 8bd8 83c404 }
            // n = 7, score = 200
            //   57                   | push                edi
            //   8b7d0c               | mov                 edi, dword ptr [ebp + 0xc]
            //   8d347d01000000       | lea                 esi, [edi*2 + 1]
            //   56                   | push                esi
            //   e8????????           |                     
            //   8bd8                 | mov                 ebx, eax
            //   83c404               | add                 esp, 4

    condition:
        7 of them and filesize < 483328
}
Download all Yara Rules