General

  • Target

    226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.bin

  • Size

    200KB

  • Sample

    201120-9w7j71xeaj

  • MD5

    c2671bf5b5dedbfd3cfe3f0f944fbe01

  • SHA1

    da3e830011e6f9d41dd6c93fdb48c47c1c6e35e1

  • SHA256

    226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2

  • SHA512

    256bc8582cc9b53b3cf9307a2882117476648ab9df540d501fc5f46a4030beacab9df2019f2d83b0a63d510803cbf6cbae01dc1325588f93a1a74521a07fe4d9

Score
10/10

Malware Config

Targets

    • Target

      226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.bin

    • Size

      200KB

    • MD5

      c2671bf5b5dedbfd3cfe3f0f944fbe01

    • SHA1

      da3e830011e6f9d41dd6c93fdb48c47c1c6e35e1

    • SHA256

      226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2

    • SHA512

      256bc8582cc9b53b3cf9307a2882117476648ab9df540d501fc5f46a4030beacab9df2019f2d83b0a63d510803cbf6cbae01dc1325588f93a1a74521a07fe4d9

    Score
    10/10
    • MountLocker Ransomware

      Ransomware family first seen in late 2020, which threatens to leak files if ransom is not paid.

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Deletes itself

    • Drops desktop.ini file(s)

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Hidden Files and Directories

1
T1158

Defense Evasion

File Deletion

2
T1107

Hidden Files and Directories

1
T1158

Impact

Inhibit System Recovery

2
T1490

Tasks