According to analysis from Joe Sandbox and Hybrid Analysis , typical indicators include: : E4272FB1E61D3D995EEA488931E815AF . File Paths : Often found in %TEMP% or on the %DESKTOP% .
: It has been documented as a downloader for Locky ransomware and has appeared in campaigns involving the RagnarLocker threat group. Soft.exe
: It modifies registry keys in HKCU\Software\Microsoft\Windows\CurrentVersion\Run and Winlogon to ensure it restarts every time the computer boots. Forensic Indicators (IOCs) According to analysis from Joe Sandbox and Hybrid