malware family

Ragnar Locker

unknownentity:malware_familyransomware · 1 source

Ragnar Locker is a ransomware identified in December 2019 that targetscorporate networks inBig Game Huntingtargeted attacks. This reportpresents recent elements regarding this ransomware.

Curated · btcintel

claims we make, each with its source and citation · sources may contradict; we show the set, never a score

Facts

id: ragnar-locker
kind: malware family
status: unknown
aliases: RagnarLocker
jurisdictions: —
claims naming it: 13 · 0 attributions · 1 relations · 0 events

Identifiers

attack S0481via mitre-attack
misp-galaxy e69f9836-873a-43d3-92a8-97ab783a4171via misp-galaxy-ransomware

Relations

MITRE ATT&CK Enterpriserecords thatFIN8usesRagnar Locker
fetch —sha256 dc1639caa5501d72
rel_664btcintel:relations:664@v1 sha256:d94ad255ba6a0335
confidenceauthority data · 60

Events

computedno dated events recorded for this entity

Claims naming this entitynewest first · 13 of 13

RagnarLockerransomwarepayment
subjecttransaction2ea17c8949…0badd70aba
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 19kcqKevFZhiX7NFLa5wAw4JBjWLcpwp3e · 100,000,000 sat · time 2021-05-07 18:47 UTC · url https://ransomwhe.re/#address/19kcqKevFZhiX7NFLa5wAw4JBjWLcpwp3e
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_26313btcintel:annotations:26313@v3 sha256:4355e4e1be223308
confidencetrusted provider · 50
RagnarLockerransomwarepayment
subjecttransactioncc35f87814…72e37e2e27
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 19kcqKevFZhiX7NFLa5wAw4JBjWLcpwp3e · 6,840,000,000 sat · time 2021-05-07 19:54 UTC · url https://ransomwhe.re/#address/19kcqKevFZhiX7NFLa5wAw4JBjWLcpwp3e
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_26312btcintel:annotations:26312@v3 sha256:9e18ebe16c43df0b
confidencetrusted provider · 50
RagnarLockerransomwarepayment address
subjectaddress19kcqKevFZhiX7NFLa5wAw4JBjWLcpwp3e
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencefamily raw RagnarLocker · url https://ransomwhe.re/#address/19kcqKevFZhiX7NFLa5wAw4JBjWLcpwp3e
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2
ann_26311btcintel:annotations:26311@v2 sha256:0ef47803e63d2357
confidencetrusted provider · 50
RagnarLockerransomwarepayment
subjecttransaction9c775e9b41…9bb19c2fae
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1CG8RAqNaJCrmEdVLK7mm2mTuuK28dkzCU · 100,000,000 sat · time 2021-03-19 21:30 UTC · url https://ransomwhe.re/#address/1CG8RAqNaJCrmEdVLK7mm2mTuuK28dkzCU
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_26310btcintel:annotations:26310@v3 sha256:1bc3db5481a8dc78
confidencetrusted provider · 50
RagnarLockerransomwarepayment
subjecttransactionba8ab57472…7d12c399e3
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1CG8RAqNaJCrmEdVLK7mm2mTuuK28dkzCU · 2,350,000,000 sat · time 2021-03-19 23:07 UTC · url https://ransomwhe.re/#address/1CG8RAqNaJCrmEdVLK7mm2mTuuK28dkzCU
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_26309btcintel:annotations:26309@v3 sha256:8b88be16348ad1c3
confidencetrusted provider · 50
RagnarLockerransomwarepayment
subjecttransaction2138420186…8b4ba4dc89
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1CG8RAqNaJCrmEdVLK7mm2mTuuK28dkzCU · 547 sat · time 2021-03-20 02:15 UTC · url https://ransomwhe.re/#address/1CG8RAqNaJCrmEdVLK7mm2mTuuK28dkzCU
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_26308btcintel:annotations:26308@v3 sha256:242332ba0c5cfa37
confidencetrusted provider · 50
RagnarLockerransomwarepayment
subjecttransactioned1587fa85…0d1a7b9840
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1CG8RAqNaJCrmEdVLK7mm2mTuuK28dkzCU · 100,000,000 sat · time 2021-03-25 19:00 UTC · url https://ransomwhe.re/#address/1CG8RAqNaJCrmEdVLK7mm2mTuuK28dkzCU
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_26307btcintel:annotations:26307@v3 sha256:b382f750f1856f44
confidencetrusted provider · 50
RagnarLockerransomwarepayment address
subjectaddress1CG8RAqNaJCrmEdVLK7mm2mTuuK28dkzCU
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencefamily raw RagnarLocker · url https://ransomwhe.re/#address/1CG8RAqNaJCrmEdVLK7mm2mTuuK28dkzCU
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2
ann_26306btcintel:annotations:26306@v2 sha256:fc3d36729afa97db
confidencetrusted provider · 50
RagnarLockerransomwarepayment
subjecttransaction4145e85c1c…9b2b41ed31
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 151Ls8urp6e2D1oXjEQAkvqogSn3TS8pp6 · 1,947,000,000 sat · time 2021-02-27 23:24 UTC · url https://ransomwhe.re/#address/151Ls8urp6e2D1oXjEQAkvqogSn3TS8pp6
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_26305btcintel:annotations:26305@v3 sha256:910629500ae118ff
confidencetrusted provider · 50
RagnarLockerransomwarepayment address
subjectaddress151Ls8urp6e2D1oXjEQAkvqogSn3TS8pp6
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencefamily raw RagnarLocker · url https://ransomwhe.re/#address/151Ls8urp6e2D1oXjEQAkvqogSn3TS8pp6
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2
ann_26304btcintel:annotations:26304@v2 sha256:54043c81ec96bee5
confidencetrusted provider · 50
RagnarLockerransomwarepayment
subjecttransaction58a22a5a40…89c24d2bc6
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 13nmJ3SsNB5pSyQrmX3e6zveY9kHGw8Vs3 · 100,000,000 sat · time 2020-07-27 23:55 UTC · url https://ransomwhe.re/#address/13nmJ3SsNB5pSyQrmX3e6zveY9kHGw8Vs3
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_2464btcintel:annotations:2464@v3 sha256:babb82ebaaf80797
confidencetrusted provider · 50
RagnarLockerransomwarepayment
subjecttransactioneb4a367416…ea399d9100
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 13nmJ3SsNB5pSyQrmX3e6zveY9kHGw8Vs3 · 41,300,065,212 sat · time 2020-07-28 00:14 UTC · url https://ransomwhe.re/#address/13nmJ3SsNB5pSyQrmX3e6zveY9kHGw8Vs3
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_2463btcintel:annotations:2463@v3 sha256:3fcba3c0949b23f8
confidencetrusted provider · 50
RagnarLockerransomwarepayment address
subjectaddress13nmJ3SsNB5pSyQrmX3e6zveY9kHGw8Vs3
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencefamily raw RagnarLocker · url https://ransomwhe.re/#address/13nmJ3SsNB5pSyQrmX3e6zveY9kHGw8Vs3
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2
ann_2462btcintel:annotations:2462@v2 sha256:4857ae60026bfdb2
confidencetrusted provider · 50

Subjects13 subjects carry a claim naming this entity · a sample

Community

notes from Nostr labelers · never merged with the bands above · not endorsed

Community content is indexed from Nostr and not endorsed by btcintel.

not computed yetNot indexed yet: the community index has not looked at this subject.