General
-
Target
6f9bed90c1d6df1c7b259f832130b5fef5e0d0c9dc6c2564dad53dc0ca30bb0e_unpacked
-
Size
68KB
-
Sample
230222-ad2tpshb23
-
MD5
49d8bd6dcaa501ca742bd686c161e5e0
-
SHA1
9acdd840615e4f4cd37f50e66b7bb7bb222d4fca
-
SHA256
6f9bed90c1d6df1c7b259f832130b5fef5e0d0c9dc6c2564dad53dc0ca30bb0e
-
SHA512
26d480f4480c99093859d3bb697dacc69c7165fc75603c717db6c1d0959463d7d9a33a32d3e1ec5360b0d031db4b77734f0ebcbf2bafb46b7390e1967d8a7b12
-
SSDEEP
768:PjzkUtPX7y4J6IjDcGopwx2P+9n+PLcHosFBLtuBDUaDO2y:0aXG4HtEPina7AdY3y
Behavioral task
behavioral1
Sample
6f9bed90c1d6df1c7b259f832130b5fef5e0d0c9dc6c2564dad53dc0ca30bb0e_unpacked.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
6f9bed90c1d6df1c7b259f832130b5fef5e0d0c9dc6c2564dad53dc0ca30bb0e_unpacked.dll
Resource
win10v2004-20230220-en
Malware Config
Extracted
C:\Users\Admin\Desktop\RecoveryManual.html
http://c6zkofycoumltpmm6zpyfadkuddpmlqk6vyd3orrfjgtq3vrgyifl6yd.onion/?cid=cf27e0d30ec88c4399a1e46b71c4a77b2199b463d99f721caed376aee6097d53
Targets
-
-
Target
6f9bed90c1d6df1c7b259f832130b5fef5e0d0c9dc6c2564dad53dc0ca30bb0e_unpacked
-
Size
68KB
-
MD5
49d8bd6dcaa501ca742bd686c161e5e0
-
SHA1
9acdd840615e4f4cd37f50e66b7bb7bb222d4fca
-
SHA256
6f9bed90c1d6df1c7b259f832130b5fef5e0d0c9dc6c2564dad53dc0ca30bb0e
-
SHA512
26d480f4480c99093859d3bb697dacc69c7165fc75603c717db6c1d0959463d7d9a33a32d3e1ec5360b0d031db4b77734f0ebcbf2bafb46b7390e1967d8a7b12
-
SSDEEP
768:PjzkUtPX7y4J6IjDcGopwx2P+9n+PLcHosFBLtuBDUaDO2y:0aXG4HtEPina7AdY3y
Score10/10-
MountLocker Ransomware
Ransomware family first seen in late 2020, which threatens to leak files if ransom is not paid.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Deletes itself
-
Drops desktop.ini file(s)
-