"BPI_Security.apk": a55a9e204ca0f1015a34f76967ab1e93d7e6ff4ab5abb4816b7438c8db41c8e7
From: https://sis-ptcadastro[.]com/app/BPI_Security.apk
Seems targeting Portugal @banco_bpi's customers.
C2 panel is named "Operador MIB 1.0" - it has BR connections.
cc @LukasStefanko@virqdroid
2020-04-14:🆕🔥#RagnarLocker (!Ragnarok) #Ransomware🔒
🇵🇹Extorting Energias de Portugal Group for 10 Mil Euro
🔦Remote Service Killer (Prevent Easy Recovery) + Backup & Database:
LogMein | ConnectWise | Splashtop| Pulseway
Prev↘️
https://t.co/AvlDfLkx3a
h/t @malwrhunterteam