Deep dive into Ragnar_locker Ransomware Gang

This report provides a technical analysis of the Ragnar_Locker ransomware gang, describing a 32-bit Windows binary that performs environment checks (language-based kill-switch), enumerates physical drives and volumes, stops backup/DB services, deletes shadow copies, generates random keys (CryptGenRandom), encrypts files with Salsa20 and protects keys with RSA, appends ragnar_[unique_hash] to files, and publishes stolen data on a leak site; it includes IOCs (multiple SHA256 hashes), MITRE ATT&CK mappings, and recommendations for prevention and recovery.