Ragnar Locker ransomware

Best Answers

• CORRECT ANSWER

  shiprasahu93 Moderator

  May 2020 Answer ✓

  Hello @TomChou ,

  SonicWall Capture Client uses the SentinelOne engine for threat protection. With rollback capabilities, we always have a restore point to go back to in case such a event took place.

  I completely understand that you are requesting for confirmation regarding this specific attack. I am working with the SentinelOne team to get more clarity on the same.

  I will keep you posted!

  Thanks!

  Shipra Sahu

  Technical Support Advisor, Premier Services

  6
• CORRECT ANSWER

  shiprasahu93 Moderator

  May 2020 Answer ✓

  Hello @TomChou,

  We have confirmation from the SentinelOne team now. So, the capture client general release 2.0.28 running S1 version 3.6.6.104 as well as the latest release 3.0.11 running S1 version 4.0.4.81 both can defend against the Ragnar Locker ransomware.

  So, the answer would be yes, you are completely protected against this ransomware attack if you have the updated client version.

  I hope that helps!

  Thanks!!

  Shipra Sahu

  Technical Support Advisor, Premier Services

  2
• CORRECT ANSWER

  KaranM Administrator

  May 2020 Answer ✓

  ThankYou @shiprasahu93

  Adding to this as per Sophos lab " Ragnar Locker works in a tricky way, the Ragnar Locker actors used a GPO task to execute Microsoft Installer (msiexec.exe), passing parameters to download and silently install a 122 MB crafted, unsigned MSI package from a remote web server.”

  “In addition to the VirtualBox files, the MSI also deploys an executable (called va.exe), a batch file (named install.bat), and a few support files. After completing the installation, the MSI Installer executes va.exe, which in turn runs the install.bat batch script. The script’s first task is to register and run the necessary VirtualBox application extensions VBoxC.dll and VBoxRT.dll, and the VirtualBox driver VboxDrv.sys,” the company added.

  
  

  SentinelOne’ s Dynamic behavior engine will block any unsigned MSI/exe file from being executed and report it back to console, hence we should detect this ransomware as well if you have the updated client version as recommended by Shipra.

  Knowledge Management Senior Analyst at SonicWall.

  4
• CORRECT ANSWER

  TomChou Newbie ✭

  May 2020 Answer ✓

  Thanks @shiprasahu93 & @KaranM  for the answer.🙂

  2