General

  • Target

    6f9bed90c1d6df1c7b259f832130b5fef5e0d0c9dc6c2564dad53dc0ca30bb0e_unpacked

  • Size

    68KB

  • Sample

    230222-ad2tpshb23

  • MD5

    49d8bd6dcaa501ca742bd686c161e5e0

  • SHA1

    9acdd840615e4f4cd37f50e66b7bb7bb222d4fca

  • SHA256

    6f9bed90c1d6df1c7b259f832130b5fef5e0d0c9dc6c2564dad53dc0ca30bb0e

  • SHA512

    26d480f4480c99093859d3bb697dacc69c7165fc75603c717db6c1d0959463d7d9a33a32d3e1ec5360b0d031db4b77734f0ebcbf2bafb46b7390e1967d8a7b12

  • SSDEEP

    768:PjzkUtPX7y4J6IjDcGopwx2P+9n+PLcHosFBLtuBDUaDO2y:0aXG4HtEPina7AdY3y

Score
10/10

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\RecoveryManual.html

Ransom Note
Your ClientId: If you are here, you want to know what happened. We infiltrated your network, controlled it for a while, examined your data, downloaded sensitive information and finally encrypted your computers. Your files are safe, but encrypted. Any attempt to decrypt files with third-party software will permanently corrupt content. What now? We advise you to be in touch and start negotiations, otherwise your confidential data will be published on few our news sites and promoted in all possible ways. Data publication and even the fact of this leak for sure will lead to significant losses for your company: government fines lawsuits and as a result legal claims payments additional expenses on law services data recovery Also you shouldn't underestimate huge damage for your reputation, which can cause crash of equity prices, clients withdrawal and other negative consequences. But don't panic! We are doing business, not war. We can unlock your data and keep everything in secret. All, what we want is a ransom. If we can reach an agreement, you also get: security report full file tree of compromised data downloaded data unrecoverable deletion support with unlocking and network protection advice. How can you contact us? Visit our support chat. It is simple, secure and you can set a password to avoid intervention of unauthorised persons. http://c6zkofycoumltpmm6zpyfadkuddpmlqk6vyd3orrfjgtq3vrgyifl6yd.onion/?cid=cf27e0d30ec88c4399a1e46b71c4a77b2199b463d99f721caed376aee6097d53 Password field should be blank for the first login. Note that this server is available via Tor browser only. Follow the instructions to open the link: Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor Project website. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it. Now you have Tor browser. In the Tor Browser open "http://c6zkofycoumltpmm6zpyfadkuddpmlqk6vyd3orrfjgtq3vrgyifl6yd.onion/?cid=cf27e0d30ec88c4399a1e46b71c4a77b2199b463d99f721caed376aee6097d53". Start a chat and introduce yourself (Company name and your position). Password field should be blank for the first login. You can ask an operator to set password later.
URLs

http://c6zkofycoumltpmm6zpyfadkuddpmlqk6vyd3orrfjgtq3vrgyifl6yd.onion/?cid=cf27e0d30ec88c4399a1e46b71c4a77b2199b463d99f721caed376aee6097d53

Targets

    • Target

      6f9bed90c1d6df1c7b259f832130b5fef5e0d0c9dc6c2564dad53dc0ca30bb0e_unpacked

    • Size

      68KB

    • MD5

      49d8bd6dcaa501ca742bd686c161e5e0

    • SHA1

      9acdd840615e4f4cd37f50e66b7bb7bb222d4fca

    • SHA256

      6f9bed90c1d6df1c7b259f832130b5fef5e0d0c9dc6c2564dad53dc0ca30bb0e

    • SHA512

      26d480f4480c99093859d3bb697dacc69c7165fc75603c717db6c1d0959463d7d9a33a32d3e1ec5360b0d031db4b77734f0ebcbf2bafb46b7390e1967d8a7b12

    • SSDEEP

      768:PjzkUtPX7y4J6IjDcGopwx2P+9n+PLcHosFBLtuBDUaDO2y:0aXG4HtEPina7AdY3y

    Score
    10/10
    • MountLocker Ransomware

      Ransomware family first seen in late 2020, which threatens to leak files if ransom is not paid.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Deletes itself

    • Drops desktop.ini file(s)

MITRE ATT&CK Enterprise v6

Tasks