RagnarLocker Analysis

Activities

Timeline

The analysis of the timeline helps to identify the required approach and handling of single vulnerabilities and vulnerability collections. This overview makes it possible to see less important slices and more severe hotspots at a glance. Initiating immediate vulnerability response and prioritizing of issues is possible.

Lang

en	303
pl	28
de	14
es	9
zh	7

Country

us	231
de	31
cn	14
ru	6
fr	6

Actors

RagnarLocker	233
RedLine	63
FIN7	25
Agrius	14
Wizard Spider	11

Activities

Interest

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need you unlock this view to get access to more details of real data.

Type

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need you unlock this view to get access to more details of real data.

Vendor

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need you unlock this view to get access to more details of real data.

Product

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need you unlock this view to get access to more details of real data.

Vulnerabilities

#	Vulnerability	Base	Temp	0day	Today	Exp	Rem	CTI	CVE
1	DZCP deV!L`z Clanportal config.php code injection	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.71	CVE-2010-0966
2	Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash information disclosure	5.3	5.2	$5k-$25k	$0-$5k	High	Workaround	0.05	CVE-2007-1192
3	Phorum register.php cross site scriting	6.3	6.0	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.07	CVE-2007-0769
4	Biometric Shift Employee Management System index.php cross site scripting	4.4	4.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.03	CVE-2017-17995
5	AlstraSoft AskMe Pro register.php cross site scriting	3.5	3.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.03
6	Trend Micro HouseCall for Home Networks Library uncontrolled search path	6.3	6.3	$5k-$25k	$5k-$25k	Not Defined	Not Defined	0.04	CVE-2021-32466
7	SSReader Ultra Star Reader ActiveX Control pdg2.dll Register memory corruption	10.0	9.4	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.06	CVE-2007-5892
8	Moreover.com Cached Feed.cgi Script cached_feed.cgi path traversal	5.3	5.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.03	CVE-2000-0906
9	cpCommerce register.php cross site scriting	4.3	4.2	$0-$5k	$0-$5k	High	Unavailable	0.03	CVE-2007-2968
10	The Address Book register.php privileges management	7.3	6.4	$0-$5k	$0-$5k	Unproven	Unavailable	0.03	CVE-2006-4580
11	PsychoStats register.php cross site scriting	3.5	3.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00
12	Phorum register.php sql injection	7.3	7.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.03	CVE-2004-2110
13	SmartDataSoft SmartBlog archive.php sql injection	7.3	7.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.03	CVE-2021-37538
14	Tiki TikiWiki tiki-editpage.php input validation	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.05	CVE-2004-1386
15	Woltlab Burning Board register.php cross site scripting	4.3	4.1	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.03	CVE-2007-1443
16	JContentSubscription register.php Local Privilege Escalation	5.3	5.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.09
17	Bitweaver register.php cross site scripting	4.3	4.1	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.03	CVE-2007-6374
18	LushiWarPlaner register.php sql injection	7.3	7.3	$0-$5k	$0-$5k	High	Unavailable	0.03	CVE-2007-0864
19	Exo ExoPHPdesk register.php cross site scripting	4.3	4.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.03	CVE-2007-5990
20	Snitz Forums 2000 register.asp cross site scripting	4.3	4.1	$0-$5k	$0-$5k	High	Official Fix	0.05	CVE-2004-2720

IOC - Indicator of Compromise (32)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Hostname	Actor	Type	Confidence
1	5.45.65.52		RagnarLocker	verified	High
2	23.106.122.192		RagnarLocker	verified	High
3	23.227.202.72	23-227-202-72.static.hvvc.us	RagnarLocker	verified	High
4	37.120.238.107		RagnarLocker	verified	High
5	45.63.89.250	45.63.89.250.vultr.com	RagnarLocker	verified	Medium
6	45.90.59.131	unallocated.layer6.net	RagnarLocker	verified	High
7	45.91.93.75	mnbbim4.uniteq.xyz	RagnarLocker	verified	High
8	XX.XXX.XX.X	xxxxxxxx.xx.xxxxxxx	Xxxxxxxxxxxx	verified	High
9	XX.XXX.XXX.XXX		Xxxxxxxxxxxx	verified	High
10	XX.XX.XX.XX	xxx-xxx-xxx-xxx.xxx.xxxxxxxx.xxx	Xxxxxxxxxxxx	verified	High
11	XX.XX.XXX.XXX	xxxxxx.xxx.xxx.xx.xx.xxxxxxx.xxxx-xxxxxx.xx	Xxxxxxxxxxxx	verified	High
12	XX.XXX.XXX.XX	xx-xxx-xxx-xx-xxxxxx.xxx.xxxxxxxxxxxxxxx.xxx	Xxxxxxxxxxxx	verified	High
13	XX.XXX.XXX.XX	xxx.xxxxxxx.xx.xx	Xxxxxxxxxxxx	verified	High
14	XX.XX.XX.XX		Xxxxxxxxxxxx	verified	High
15	XX.XXX.XXX.XXX	xxxxxx.xxx.xxx.xxx.xx.xxxxxxx.xxxx-xxxxxx.xx	Xxxxxxxxxxxx	verified	High
16	XXX.XX.XXX.XXX	xxxx-xxx-xx-xxx-xxx.xxxxxx.xxxx.xxxxxxx.xxx	Xxxxxxxxxxxx	verified	High
17	XXX.XX.XXX.XXX	xxxx-xxx-xx-xxx-xxx.xxxxxx.xxxx.xxxxxxx.xxx	Xxxxxxxxxxxx	verified	High
18	XXX.XXX.XXX.XX	xxxxxx.xx.xxx.xxx.xxx.xxxxxxx.xxxx-xxxxxx.xx	Xxxxxxxxxxxx	verified	High
19	XXX.XX.XXX.XX	xxxx.xx-xxx-xx-xxx.xxx	Xxxxxxxxxxxx	verified	High
20	XXX.XX.XXX.XXX	xxx.xx.xxx.xxx.xxxxx.xxx	Xxxxxxxxxxxx	verified	Medium
21	XXX.XX.XXX.X	xxxxx.xxxxxxxxxxx.xxx.xx	Xxxxxxxxxxxx	verified	High
22	XXX.XX.XX.XX	xxxxxx.xx.xx.xx.xxx.xxxxxxx.xxxx-xxxxxx.xx	Xxxxxxxxxxxx	verified	High
23	XXX.XX.XXX.XX	xxx.xxx.xxxxx.xxx	Xxxxxxxxxxxx	verified	High
24	XXX.XXX.XXX.XX	xxxxxx.xxx	Xxxxxxxxxxxx	verified	High
25	XXX.XXX.XXX.XXX	xxxxxxxxx.xxxxxxxxx.xxxx	Xxxxxxxxxxxx	verified	High
26	XXX.XXX.XXX.XXX		Xxxxxxxxxxxx	verified	High
27	XXX.XX.XX.XX	xxxxxxxx.xxxxxxxxxxxxxxx.xxx	Xxxxxxxxxxxx	verified	High
28	XXX.XX.XX.XX	xxxxxxxxxxxxxxx.xxxxxxxxxxxxxxxxx.xxx	Xxxxxxxxxxxx	verified	High
29	XXX.XXX.XXX.XX	xxx.xxx.xxx.xx.xxxxxxxxx-xxx	Xxxxxxxxxxxx	verified	High
30	XXX.XX.XX.XX	xxx-xx-xx-xx-xxxx.xxxxxxxxxxxx.xxx	Xxxxxxxxxxxx	verified	High
31	XXX.XX.XXX.XXX	xxx-xx-xxx-xxx-xxxx.xxxxxxxxxxxx.xxx	Xxxxxxxxxxxx	verified	High
32	XXX.XX.XX.XXX	xxxxxx-xxxxxxx.xxxxx.xx	Xxxxxxxxxxxx	verified	High

TTP - Tactics, Techniques, Procedures (7)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Vulnerabilities	Access Vector	Type	Confidence
1	T1059.007	CWE-79, CWE-80	Cross Site Scripting	predictive	High
2	T1068	CWE-264, CWE-284	Execution with Unnecessary Privileges	predictive	High
3	TXXXX	CWE-XXX	7xx Xxxxxxxx Xxxxxxxx	predictive	High
4	TXXXX	CWE-XXX	Xxxxxxxxxx Xxxxxx	predictive	High
5	TXXXX.XXX	CWE-XXX	Xxxxxxxx Xxxxxxxxxxxxx	predictive	High
6	TXXXX	CWE-XXX	Xxxxxxxxxxx Xxxxxxx Xx Xxxxxxxxxxx	predictive	High
7	TXXXX	CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	High

IOA - Indicator of Attack (156)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Class	Indicator	Type	Confidence
1	File	/adminlogin.asp	predictive	High
2	File	/category_view.php	predictive	High
3	File	/forum/away.php	predictive	High
4	File	/HNAP1	predictive	Low
5	File	/mc-admin/post.php?state=delete&delete	predictive	High
6	File	/public/login.htm	predictive	High
7	File	/usr/ucb/mail	predictive	High
8	File	/wp-content/plugins/updraftplus/admin.php	predictive	High
9	File	adclick.php	predictive	Medium
10	File	addmember.php	predictive	High
11	File	addtocart.asp	predictive	High
12	File	addtomylist.asp	predictive	High
13	File	admin.x-shop.php	predictive	High
14	File	admin/auth.php	predictive	High
15	File	admin/import/class-import-settings.php	predictive	High
16	File	admin/sqlpatch.php	predictive	High
17	File	admincp/auth/checklogin.php	predictive	High
18	File	adminlogin.asp	predictive	High
19	File	aj.html	predictive	Low
20	File	ajax/autocompletion.php	predictive	High
21	File	xxxxxxxxxxx/xxxxx/xxxxxxxxxx/xxxxxxx.xxx	predictive	High
22	File	xxxx/xxxxxxxxxx/xxxxxx.xxx	predictive	High
23	File	xxxxxxx.xx	predictive	Medium
24	File	x:\xxxxxxx\xxxxxxxx\xxxxxx\xxx	predictive	High
25	File	xxxxxx_xxxx.xxx	predictive	High
26	File	xxx.xxx	predictive	Low
27	File	xxxxxxxx.xxx	predictive	Medium
28	File	xxx-xxx/xxxxxxxxxxx/xxxxxxxxx.xxx	predictive	High
29	File	xxx-xxx/xxxxxxxxxxxx.xxx	predictive	High
30	File	xxx-xxx/xxxxxx/xxxxx.xx	predictive	High
31	File	xxxxxxxxxxx/xxxxx/xxxxxxx.xxx	predictive	High
32	File	xxxx/xxxx/xxx.xxxxxxx.xxxxxxx/xxxxxx_xxxxx/xxx.xxx	predictive	High
33	File	xxxx/xxxxxxxxxxxxxxx.xxx	predictive	High
34	File	xxx.xxx	predictive	Low
35	File	xxxxxx.xxx	predictive	Medium
36	File	xxxxxxxx.xxx	predictive	Medium
37	File	xxxxxxx/xxxxxxx.xxx	predictive	High
38	File	xxxx.x	predictive	Low
39	File	xxxxx.xxx	predictive	Medium
40	File	xxxx.xxx	predictive	Medium
41	File	xxxxxxxxx.xxx	predictive	High
42	File	xxxxxxxx.xxx	predictive	Medium
43	File	xxxxxxxxx.xxx	predictive	High
44	File	xxx/xxxxxx.xxx	predictive	High
45	File	xxxxxxx/xxxxxxx/xxxxxxxx.xxx.xxx	predictive	High
46	File	xxxxxxx/xxxxxxx/xxxxxxxx_xxxxxxxx.xxx.xxx	predictive	High
47	File	xxxxxxx/xxxxxx/xxxxxxx/xxxxxx/xxx.xxx	predictive	High
48	File	xxxxxxxx/xxxx.xxx	predictive	High
49	File	xxxxx.xxx	predictive	Medium
50	File	xxxxxxx.xxx.xxx	predictive	High
51	File	xx.xxx	predictive	Low
52	File	xxxx.xxx	predictive	Medium
53	File	xxxxx/xxxxx.xxx	predictive	High
54	File	xxxx/x/xxxxxx.x	predictive	High
55	File	xxxxx.xxx	predictive	Medium
56	File	xxxxxxx.xxx	predictive	Medium
57	File	xx_xxxx.x	predictive	Medium
58	File	xxxxxxxxx.xx	predictive	Medium
59	File	xxx	predictive	Low
60	File	xxx.x	predictive	Low
61	File	xxxxx/xxxxxxx.x	predictive	High
62	File	xxxxx-xxxxx.x	predictive	High
63	File	xxxxxxx.xxx	predictive	Medium
64	File	xxxxx.xxx	predictive	Medium
65	File	xxxxxxxxxx.xxx	predictive	High
66	File	xxxxxxxx.xxx	predictive	Medium
67	File	xxxxxxxx.xxx	predictive	Medium
68	File	xxxxxxxx.xx	predictive	Medium
69	File	xxxxxx.xxx	predictive	Medium
70	File	xxxxxx.xxx	predictive	Medium
71	File	xxxxxx_xxxx.xxx	predictive	High
72	File	xxxxxx/xxxxxxxx.xxx	predictive	High
73	File	xxxxxx_xxx_xxxxxx.xxx	predictive	High
74	File	xxxx.xxx	predictive	Medium
75	File	xxxx/xxxx.xxx	predictive	High
76	File	xxxxxxxxxxx.xxx	predictive	High
77	File	xxxx-xxxxxxxx.xxx	predictive	High
78	File	xxxx-xxxx_xxxx_xxxxxxx.xxx	predictive	High
79	File	xxxx.xxx	predictive	Medium
80	File	xxxxxxxx-x.x	predictive	Medium
81	File	xxxxxx.xxx	predictive	Medium
82	File	xxxxxx.xxx	predictive	Medium
83	File	xxx.xxx	predictive	Low
84	File	xxxxx/xxxxxxxx.xxx	predictive	High
85	File	xxxx.xxx	predictive	Medium
86	File	xxxx/xxxxxxxx.xxx	predictive	High
87	File	xxxx_xxx.xxx	predictive	Medium
88	File	xx-xxxxxxxx-xxxx.xxx	predictive	High
89	File	xx-xxxxxxxx.xxx	predictive	High
90	File	xxx/xxxx/xx/xxxxxxx.xxx	predictive	High
91	File	~/xxx/xxxxxxxxx/xxxx/xxxx/xxxxxx.xxx	predictive	High
92	Library	xxxxx/xxxxxxxxx/xxxxx.xxxxxxxxx.xxx	predictive	High
93	Library	xxxxxxxx.xxx	predictive	Medium
94	Library	xxxx.xxx	predictive	Medium
95	Library	xxxxxxx.xxx	predictive	Medium
96	Argument	xxxxxx	predictive	Low
97	Argument	xxxxxxxx	predictive	Medium
98	Argument	xxxx_xxx	predictive	Medium
99	Argument	xxxxxxxxx xx xxxxxxx	predictive	High
100	Argument	xxx	predictive	Low
101	Argument	xxxxxxxx/xxxxxx	predictive	High
102	Argument	xxxxxxxx_xx	predictive	Medium
103	Argument	xxxxxxxxxx	predictive	Medium
104	Argument	xxxxxxx	predictive	Low
105	Argument	xxxxxx	predictive	Low
106	Argument	xxxxxx	predictive	Low
107	Argument	xxxxxxx	predictive	Low
108	Argument	xxxx	predictive	Low
109	Argument	xxxxx	predictive	Low
110	Argument	xxxxx_xxxx_xxxx	predictive	High
111	Argument	xxxxx	predictive	Low
112	Argument	xxxxx_xxxxxxxxxxx	predictive	High
113	Argument	xxxxxx	predictive	Low
114	Argument	xxxx_xxxxx	predictive	Medium
115	Argument	xxxx_xxxxxxx	predictive	Medium
116	Argument	xx	predictive	Low
117	Argument	xx	predictive	Low
118	Argument	xxxxxxxxxxxxxxxx	predictive	High
119	Argument	xxxxxxx_xxxx	predictive	Medium
120	Argument	xxxxxxxxx	predictive	Medium
121	Argument	xxxx	predictive	Low
122	Argument	xxxx	predictive	Low
123	Argument	xxxx_xxxx	predictive	Medium
124	Argument	xxxxxxxxxxxxxx	predictive	High
125	Argument	xxxxxxxxxxxxx	predictive	High
126	Argument	xxxxxxxx	predictive	Medium
127	Argument	xxxx	predictive	Low
128	Argument	xxxxxxxxx_xxxxxxxx_xxxx	predictive	High
129	Argument	xxxx	predictive	Low
130	Argument	xxxx	predictive	Low
131	Argument	xx_xxxxxxxxxxx	predictive	High
132	Argument	xxxx_xxxx	predictive	Medium
133	Argument	xxxxx_xxxx_xxxx	predictive	High
134	Argument	xxxxxxx	predictive	Low
135	Argument	xxxxx_xxxxxx	predictive	Medium
136	Argument	xxxxxxxxxxx	predictive	Medium
137	Argument	xxxxxxxxxxxx	predictive	Medium
138	Argument	xxxxxxxxxx	predictive	Medium
139	Argument	xxxx_xxxx	predictive	Medium
140	Argument	xxxxxxxxxx_xxxx	predictive	High
141	Argument	xxxxxxxxxx	predictive	Medium
142	Argument	xxx	predictive	Low
143	Argument	xxxx	predictive	Low
144	Argument	xxxx_xx[]	predictive	Medium
145	Argument	xxx	predictive	Low
146	Argument	xxxx-xxxxx	predictive	Medium
147	Argument	xxxxxxxx	predictive	Medium
148	Argument	xxxxxxxx/xxxxxxxx	predictive	High
149	Argument	xxxx_xxxxx	predictive	Medium
150	Argument	xxxx_xxxxx	predictive	Medium
151	Argument	xxxxx_xxx	predictive	Medium
152	Argument	xxxx	predictive	Low
153	Argument	_xxx_xxxxxxx_xxxxx_xxxx_xxx_xxxxxxx_xxxxxxxxxxxxxxxx_xxxxx	predictive	High
154	Argument	__xxxxxxxxx	predictive	Medium
155	Input Value	'xx''='	predictive	Low
156	Input Value	xxxxxxxxxxxxxxxxxxxxxxxxxxxx+xxxxx+xxxxxx+x,x,xxxx,xxx,x,x+xxxx+xxx_xxxxx+xxxxx+xx=x--+	predictive	High

References (2)

The following list contains external sources which discuss the actor and the associated activities:

◂ PreviousOverviewNext ▸

Do you want to use VulDB in your project?

Use the official API to access entries easily!