mountlocker | 7346716133[.]zip | Triage

Sharing

General

Target

7346716133.zip
Size

25KB
MD5

ee2079bd3b2a0c7df6980c079b8ba492
SHA1

2c256899afda930f47e9472d1b2b22867414a62d
SHA256

89182daada0c90a1dcbb9830338b9033f351d24a0f15aa061c94f9d9b81a1be3
SHA512

c8b1d7fe822613c7dcb546039c999ef28fd0581af1dc18a35afb6230a63c823469a0e818af0e3caa102949ef18c632c3465cc1a267ae554b33067145f1a3d471
SSDEEP

384:8BrND6UGmTUwrbvw5OKdBhqgn1Ikd009XYxnUSwp1PxLmOtoflj9SO8v:8BrNa+ej7hBn1ImrVYxnkPPxLHSljh8v

Score

10^/10

mountlocker

Malware Config

Signatures

Detected Mount Locker ransomware 1 IoCs

Processes:

resource	yara_rule
static1/unpack001/8f6c709b9940e39dde52dc9c617642b1a7ec037d537ec2c1d993734c05af0896	RANSOM_mountlocker

Mountlocker family
mountlocker

Files

7346716133.zip
.zip

Password: infected
8f6c709b9940e39dde52dc9c617642b1a7ec037d537ec2c1d993734c05af0896
.dll windows x64

Password: infected

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.text
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

bss
Size: - Virtual size: 136B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 888B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 212B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ