Overview

overview

10

Static

static

1

0fc52ab540...44.exe

windows7_x64

10

0fc52ab540...44.exe

windows10_x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0fc52ab540452b524dadb3a7dbcd2a7f1c2d5c553229d77cfbff0d800f8c0f44

  • Size

    3.1MB

  • Sample

    211129-nlqnascaek

  • MD5

    368b0fb9d3ecf41b8d013c4d1fa7c0e5

  • SHA1

    a38c5270ef62704a0b9653f301b75216bcdf527d

  • SHA256

    0fc52ab540452b524dadb3a7dbcd2a7f1c2d5c553229d77cfbff0d800f8c0f44

  • SHA512

    cabb1fd33f67ec77272cad53651f98f6dc6e335e87f10e88d8a0dc4e85b2e2f8e8c8097c02909b6ea22aa9df5a18b3835d93b3c32ebcf468a3533becbe76087a

Score
10/10
mountlockerransomware

Malware Config

Extracted

Path

\??\c:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\RecoveryManual.html

Ransom Note
<html> <head> <title>RECOVERY MANUAL</title> </head> <body> <h1>Your ClientId:</h1> <b> <pre> 7d4476319502df7952972775d8cf930672df985a7c38e89a2d625284284e8540 </pre> </b> <hr/> <b>/!\ YOUR NETWORK HAS BEEN HACKED /!\<br> All your important files have been encrypted!</b><br> <hr/> Your files are safe! Only encrypted.<br><br> ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br> WILL PERMANENTLY CORRUPT IT.<br> DO NOT MODIFY ENCRYPTED FILES.<br> DO NOT RENAME ENCRYPTED FILES.<br><br> No software available on internet can help you. We are the only ones able to<br> solve your problem.<br><br> You can send us 2-3 files and we will decrypt it for free<br> to prove we are able to give your files back.<br><br> Also we gathered highly confidential/personal data from your network. These data are currently stored on<br> a private server. This server will be immediately destroyed after your payment.<br> If you won't pay, we will release your data to public or reseller.<br> So you can expect your data to be published or improperly used in the near future.<br> In this case you will face all legal and reputational consequences of the leak.<br> We only desire to get a ransom and we don't aim to damage your reputation or destroy<br> your business.<br><br> <hr/> <b>Contact us to discuss your next step.</b><br><br> <a href="http://u5aift7e2s7h5d6hnl6wqkecfor7g6ltwwljbqciek52anm35n3rqiid.onion/?cid=7d4476319502df7952972775d8cf930672df985a7c38e89a2d625284284e8540">http://u5aift7e2s7h5d6hnl6wqkecfor7g6ltwwljbqciek52anm35n3rqiid.onion/?cid=7d4476319502df7952972775d8cf930672df985a7c38e89a2d625284284e8540</a><br> * Password field could be blank <br><br> * Note that this server is only available via Tor browser only<br><br> Follow the instructions to open the link:<br> 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br> 2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br> 3. Now you have Tor browser. In the Tor Browser open "http://u5aift7e2s7h5d6hnl6wqkecfor7g6ltwwljbqciek52anm35n3rqiid.onion/?cid=7d4476319502df7952972775d8cf930672df985a7c38e89a2d625284284e8540". <br> 4. Start a chat and follow the further instructions. (Password field should be empty for the first login). <br><br> <hr/> Please note, sometimes our support is away from keyboard, but we will reply shortly.<br> Kindly advise you to contact us as soon as possible.<br></b><br> </body> </html>

Targets

    • Target

      0fc52ab540452b524dadb3a7dbcd2a7f1c2d5c553229d77cfbff0d800f8c0f44

    • Size

      3.1MB

    • MD5

      368b0fb9d3ecf41b8d013c4d1fa7c0e5

    • SHA1

      a38c5270ef62704a0b9653f301b75216bcdf527d

    • SHA256

      0fc52ab540452b524dadb3a7dbcd2a7f1c2d5c553229d77cfbff0d800f8c0f44

    • SHA512

      cabb1fd33f67ec77272cad53651f98f6dc6e335e87f10e88d8a0dc4e85b2e2f8e8c8097c02909b6ea22aa9df5a18b3835d93b3c32ebcf468a3533becbe76087a

    Score
    10/10
    mountlockerransomware

    • MountLocker Ransomware

      Ransomware family first seen in late 2020, which threatens to leak files if ransom is not paid.

      ransomwaremountlocker

    • Executes dropped EXE

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Loads dropped DLL

    • Drops desktop.ini file(s)

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks