General
-
Target
0AACF2C41BA9B872A52055FFCAEAEF15
-
Size
77KB
-
Sample
201029-wrhynhybq6
-
MD5
0aacf2c41ba9b872a52055ffcaeaef15
-
SHA1
c09b509699aeef71f3e205d53c5f4ff71cb48570
-
SHA256
31630d16f4564c7a214a206a58f60b7623cd1b3abb823d10ed50aa077ca33585
-
SHA512
d259de51d22d72d27d5947530317661b97ba8fcc36e7a2ad4835e98bc311ef1aa5964f939660733171934f6aefa82d8b76a6f9f04137e1aeca63d592f0fb26ec
Static task
static1
Behavioral task
behavioral1
Sample
0AACF2C41BA9B872A52055FFCAEAEF15.dll
Resource
win7v20201028
Behavioral task
behavioral2
Sample
0AACF2C41BA9B872A52055FFCAEAEF15.dll
Resource
win10v20201028
Malware Config
Extracted
C:\Users\Admin\Desktop\RecoveryManual.html
mountlocker
http://qiludmxlqqotacf62iycexcohbka4ezresf5jmwdoh7iyk3tgguzaaqd.onion/?cid=d11ebd6225c2dd096733ff8dad28b64321dc827ac5a37515abe00375993d6d3b
Extracted
C:\Users\Admin\Desktop\RecoveryManual.html
mountlocker
http://qiludmxlqqotacf62iycexcohbka4ezresf5jmwdoh7iyk3tgguzaaqd.onion/?cid=d11ebd6225c2dd096733ff8dad28b64321c29f68dfb06303abe00375993d6d49
Targets
-
-
Target
0AACF2C41BA9B872A52055FFCAEAEF15
-
Size
77KB
-
MD5
0aacf2c41ba9b872a52055ffcaeaef15
-
SHA1
c09b509699aeef71f3e205d53c5f4ff71cb48570
-
SHA256
31630d16f4564c7a214a206a58f60b7623cd1b3abb823d10ed50aa077ca33585
-
SHA512
d259de51d22d72d27d5947530317661b97ba8fcc36e7a2ad4835e98bc311ef1aa5964f939660733171934f6aefa82d8b76a6f9f04137e1aeca63d592f0fb26ec
Score10/10-
MountLocker Ransomware
Ransomware family first seen in late 2020, which threatens to leak files if ransom is not paid.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Deletes itself
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Modifies service
-