Resubmissions

21-04-2021 05:57

210421-6629fr1gja 10

20-04-2021 23:42

210420-mt2kpcnwbx 10

20-04-2021 23:39

210420-4kmcwg1k3a 10

General

  • Target

    43064ebb9fccce989e8a8ebe2e8ee5df154b55f7b94d933e0cf7dba6ac765f00.exe

  • Size

    4.5MB

  • Sample

    210420-mt2kpcnwbx

  • MD5

    787d10a041bd8d2654b6f14467f123d7

  • SHA1

    0dc98264957990391bd375a3e9ce9f0e047c1075

  • SHA256

    43064ebb9fccce989e8a8ebe2e8ee5df154b55f7b94d933e0cf7dba6ac765f00

  • SHA512

    dbb450db73b030531b57fb5809b22b60730e13445ff02a032be5abb3668285122564cc1792fc3f44520a434b48656de7a22e931cc35d762a0704078f7021686f

Score
10/10

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\RecoveryManual.html

Ransom Note
Your ClientId: /!\ YOUR NETWORK HAS BEEN HACKED /!\ All your important files have been encrypted! Your files are safe! Only encrypted. ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE WILL PERMANENTLY CORRUPT IT. DO NOT MODIFY ENCRYPTED FILES. DO NOT RENAME ENCRYPTED FILES. No software available on internet can help you. We are the only ones able to solve your problem. You can send us 2-3 files and we will decrypt it for free to prove we are able to give your files back. Also we gathered highly confidential/personal data from your network. These data are currently stored on a private server. This server will be immediately destroyed after your payment. If you won't pay, we will release your data to public or reseller. So you can expect your data to be published or improperly used in the near future. In this case you will face all legal and reputational consequences of the leak. We only desire to get a ransom and we don't aim to damage your reputation or destroy your business. Contact us to discuss your next step. http://lhvqpdydwvtgy2ficsvamluobvonnitji5jgpfvc7c5pj6ci35gurjyd.onion/?cid=c7756a52c92cfb896c41800ac9bbe0c82ec8934d65d09c4b4780f215bbdd154f * Note that this server is only available via Tor browser only Follow the instructions to open the link: 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site. 2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it. 3. Now you have Tor browser. In the Tor Browser open "http://lhvqpdydwvtgy2ficsvamluobvonnitji5jgpfvc7c5pj6ci35gurjyd.onion/?cid=c7756a52c92cfb896c41800ac9bbe0c82ec8934d65d09c4b4780f215bbdd154f". 4. Start a chat and follow the further instructions. (Password field should be empty for the first login). If you can`t use the above link, use the email: MartinMacDonald1996@protonmail.com Please note, sometimes our support is away from keyboard, but we will reply shortly. Kindly advise you to contact us as soon as possible.
Emails

MartinMacDonald1996@protonmail.com

URLs

http://lhvqpdydwvtgy2ficsvamluobvonnitji5jgpfvc7c5pj6ci35gurjyd.onion/?cid=c7756a52c92cfb896c41800ac9bbe0c82ec8934d65d09c4b4780f215bbdd154f

Targets

    • Target

      43064ebb9fccce989e8a8ebe2e8ee5df154b55f7b94d933e0cf7dba6ac765f00.exe

    • Size

      4.5MB

    • MD5

      787d10a041bd8d2654b6f14467f123d7

    • SHA1

      0dc98264957990391bd375a3e9ce9f0e047c1075

    • SHA256

      43064ebb9fccce989e8a8ebe2e8ee5df154b55f7b94d933e0cf7dba6ac765f00

    • SHA512

      dbb450db73b030531b57fb5809b22b60730e13445ff02a032be5abb3668285122564cc1792fc3f44520a434b48656de7a22e931cc35d762a0704078f7021686f

    Score
    10/10
    • MountLocker Ransomware

      Ransomware family first seen in late 2020, which threatens to leak files if ransom is not paid.

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Executes dropped EXE

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Drops desktop.ini file(s)

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Hidden Files and Directories

1
T1158

Defense Evasion

File Deletion

2
T1107

Modify Registry

1
T1112

Hidden Files and Directories

1
T1158

Impact

Inhibit System Recovery

2
T1490

Tasks