General

  • Target

    b07e554eff514d0dd77f3cf52e011fe315c21054053032a64c70699fe5336894.bin.sample

  • Size

    118KB

  • Sample

    210331-9dw4tmxfrj

  • MD5

    2f21dd9d6c0862dad443a5c95420816f

  • SHA1

    ab888a86691db3a013d97e38865cb5f289e30e65

  • SHA256

    b07e554eff514d0dd77f3cf52e011fe315c21054053032a64c70699fe5336894

  • SHA512

    ffce995792446ac40c4f1bc3da86363fb892da7b2a9d673f328b9cf9bb4a7dc9d134a26cdb472aefeeb9d6afcdc2a39107c90c286a30837fb168998c6f9de24b

Score
10/10

Malware Config

Extracted

Path

C:\Users\Public\Desktop\RecoveryManual.html

Ransom Note
Your ClientId: /!\ YOUR NETWORK HAS BEEN HACKED /!\ All your important files have been encrypted! Your files are safe! Only encrypted. ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE WILL PERMANENTLY CORRUPT IT. DO NOT MODIFY ENCRYPTED FILES. DO NOT RENAME ENCRYPTED FILES. No software available on internet can help you. We are the only ones able to solve your problem. You can send us 2-3 files and we will decrypt it for free to prove we are able to give your files back. Also we gathered highly confidential/personal data from your network. These data are currently stored on a private server. This server will be immediately destroyed after your payment. If you won't pay, we will release your data to public or reseller. So you can expect your data to be published or improperly used in the near future. In this case you will face all legal and reputational consequences of the leak. We only desire to get a ransom and we don't aim to damage your reputation or destroy your business. Contact us to discuss your next step. http://7bzo3bkpgrm3n4g6ot3jtc45tna7ijw2ibtfcuwnfj44zwfjwfrvszyd.onion/?cid=143ca1749b19662fa0c035df8eb6ae507432c1b80ecc80a211b3e4dd1349bb49 * Password field could be blank * Note that this server is only available via Tor browser only Follow the instructions to open the link: 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site. 2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it. 3. Now you have Tor browser. In the Tor Browser open "http://7bzo3bkpgrm3n4g6ot3jtc45tna7ijw2ibtfcuwnfj44zwfjwfrvszyd.onion/?cid=143ca1749b19662fa0c035df8eb6ae507432c1b80ecc80a211b3e4dd1349bb49". 4. Start a chat and follow the further instructions. (Password field should be empty for the first login). Please note, sometimes our support is away from keyboard, but we will reply shortly. Kindly advise you to contact us as soon as possible.
URLs

http://7bzo3bkpgrm3n4g6ot3jtc45tna7ijw2ibtfcuwnfj44zwfjwfrvszyd.onion/?cid=143ca1749b19662fa0c035df8eb6ae507432c1b80ecc80a211b3e4dd1349bb49

Targets

    • Target

      b07e554eff514d0dd77f3cf52e011fe315c21054053032a64c70699fe5336894.bin.sample

    • Size

      118KB

    • MD5

      2f21dd9d6c0862dad443a5c95420816f

    • SHA1

      ab888a86691db3a013d97e38865cb5f289e30e65

    • SHA256

      b07e554eff514d0dd77f3cf52e011fe315c21054053032a64c70699fe5336894

    • SHA512

      ffce995792446ac40c4f1bc3da86363fb892da7b2a9d673f328b9cf9bb4a7dc9d134a26cdb472aefeeb9d6afcdc2a39107c90c286a30837fb168998c6f9de24b

    Score
    10/10
    • MountLocker Ransomware

      Ransomware family first seen in late 2020, which threatens to leak files if ransom is not paid.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Deletes itself

    • Drops desktop.ini file(s)

MITRE ATT&CK Enterprise v6

Tasks