Overview

overview

10

Static

static

b07e554eff...le.dll

windows7_x64

10

b07e554eff...le.dll

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    b07e554eff514d0dd77f3cf52e011fe315c21054053032a64c70699fe5336894.bin.sample
  • Size 118KB
  • Sample210331-9dw4tmxfrj
  • SHA256 b07e554eff514d0dd77f3cf52e011fe315c21054053032a64c70699fe5336894
  • MD5 SHA1 SHA512
Score
10/10
mountlockerransomware

Malware Config

Extracted

Path

  • C:\Users\Public\Desktop\RecoveryManual.html

Ransom Note
  • Your ClientId: /!\ YOUR NETWORK HAS BEEN HACKED /!\ All your important files have been encrypted! Your files are safe! Only encrypted. ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE WILL PERMANENTLY CORRUPT IT. DO NOT MODIFY ENCRYPTED FILES. DO NOT RENAME ENCRYPTED FILES. No software available on internet can help you. We are the only ones able to solve your problem. You can send us 2-3 files and we will decrypt it for free to prove we are able to give your files back. Also we gathered highly confidential/personal data from your network. These data are currently stored on a private server. This server will be immediately destroyed after your payment. If you won't pay, we will release your data to public or reseller. So you can expect your data to be published or improperly used in the near future. In this case you will face all legal and reputational consequences of the leak. We only desire to get a ransom and we don't aim to damage your reputation or destroy your business. Contact us to discuss your next step. http://7bzo3bkpgrm3n4g6ot3jtc45tna7ijw2ibtfcuwnfj44zwfjwfrvszyd.onion/?cid=143ca1749b19662fa0c035df8eb6ae507432c1b80ecc80a211b3e4dd1349bb49 * Password field could be blank * Note that this server is only available via Tor browser only Follow the instructions to open the link: 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site. 2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it. 3. Now you have Tor browser. In the Tor Browser open "http://7bzo3bkpgrm3n4g6ot3jtc45tna7ijw2ibtfcuwnfj44zwfjwfrvszyd.onion/?cid=143ca1749b19662fa0c035df8eb6ae507432c1b80ecc80a211b3e4dd1349bb49". 4. Start a chat and follow the further instructions. (Password field should be empty for the first login). Please note, sometimes our support is away from keyboard, but we will reply shortly. Kindly advise you to contact us as soon as possible.
URLs

  • http://7bzo3bkpgrm3n4g6ot3jtc45tna7ijw2ibtfcuwnfj44zwfjwfrvszyd.onion/?cid=143ca1749b19662fa0c035df8eb6ae507432c1b80ecc80a211b3e4dd1349bb49

Targets

    • Target
      b07e554eff514d0dd77f3cf52e011fe315c21054053032a64c70699fe5336894.bin.sample
    • Size 118KB
    • SHA256 b07e554eff514d0dd77f3cf52e011fe315c21054053032a64c70699fe5336894
    • MD5 SHA1 SHA512
    Score
    10/10
    mountlockerransomware

    • MountLocker Ransomware

      Ransomware family first seen in late 2020, which threatens to leak files if ransom is not paid.

      ransomwaremountlocker

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Deletes itself

    • Drops desktop.ini file(s)

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks