General
-
Target
4a5ac3c6f8383cc33c795804ba5f7f5553c029bbb4a6d28f1e4d8fb5107902c1
-
Size
66KB
-
Sample
230222-af6knsba4x
-
MD5
3808f21e56dede99bc914d90aeabe47a
-
SHA1
93cc73149d4bb34830a2cb2a3047e9267b9e3080
-
SHA256
4a5ac3c6f8383cc33c795804ba5f7f5553c029bbb4a6d28f1e4d8fb5107902c1
-
SHA512
4ae55145cca3a6f1ed3feff5b2bd38121e37c4cc528e08d5de771bcc4855994560bfc8c22898d73c5b259e37d2dc803615b8f6ec859e53918bd7a1ffee9316b3
-
SSDEEP
768:BS5zkUtPX/y4Jp5LmcmItHnlIH9q9Q/048RgauHADOC8:DaXq4xTlIdYrhRcHC8
Behavioral task
behavioral1
Sample
4a5ac3c6f8383cc33c795804ba5f7f5553c029bbb4a6d28f1e4d8fb5107902c1.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
4a5ac3c6f8383cc33c795804ba5f7f5553c029bbb4a6d28f1e4d8fb5107902c1.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
C:\Users\Admin\Desktop\RecoveryManual.html
http://w6ilafwwrgtrmilorzqex6pgpvfsa667fydca2wpoluj6sajka225byd.onion/?cid=879538e20b82e80052dd5f7ef9ad50777a3fe78c5e10f49d2f5189fb60588853
Extracted
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\RecoveryManual.html
http://w6ilafwwrgtrmilorzqex6pgpvfsa667fydca2wpoluj6sajka225byd.onion/?cid=879538e20b82e80052dd5f7ef9ad50776c23ef985e09e7862f5189fb6058883e
Targets
-
-
Target
4a5ac3c6f8383cc33c795804ba5f7f5553c029bbb4a6d28f1e4d8fb5107902c1
-
Size
66KB
-
MD5
3808f21e56dede99bc914d90aeabe47a
-
SHA1
93cc73149d4bb34830a2cb2a3047e9267b9e3080
-
SHA256
4a5ac3c6f8383cc33c795804ba5f7f5553c029bbb4a6d28f1e4d8fb5107902c1
-
SHA512
4ae55145cca3a6f1ed3feff5b2bd38121e37c4cc528e08d5de771bcc4855994560bfc8c22898d73c5b259e37d2dc803615b8f6ec859e53918bd7a1ffee9316b3
-
SSDEEP
768:BS5zkUtPX/y4Jp5LmcmItHnlIH9q9Q/048RgauHADOC8:DaXq4xTlIdYrhRcHC8
Score10/10-
MountLocker Ransomware
Ransomware family first seen in late 2020, which threatens to leak files if ransom is not paid.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Deletes itself
-
Drops desktop.ini file(s)
-