mountlocker | 4a5ac3c6f8383cc33c795804ba5f7f5553c029bbb4a6d28f1e4d8fb5107902c1

Sharing

Copy URL

Twitter E-mail

General

Target

4a5ac3c6f8383cc33c795804ba5f7f5553c029bbb4a6d28f1e4d8fb5107902c1
Size

66KB
MD5

3808f21e56dede99bc914d90aeabe47a
SHA1

93cc73149d4bb34830a2cb2a3047e9267b9e3080
SHA256

4a5ac3c6f8383cc33c795804ba5f7f5553c029bbb4a6d28f1e4d8fb5107902c1
SHA512

4ae55145cca3a6f1ed3feff5b2bd38121e37c4cc528e08d5de771bcc4855994560bfc8c22898d73c5b259e37d2dc803615b8f6ec859e53918bd7a1ffee9316b3
SSDEEP

768:BS5zkUtPX/y4Jp5LmcmItHnlIH9q9Q/048RgauHADOC8:DaXq4xTlIdYrhRcHC8

Score

10^/10

mountlocker

Malware Config

Signatures

Detected Mount Locker ransomware 1 IoCs

Processes:

resource yara_rule

sample RANSOM_mountlocker
Mountlocker family
mountlocker

resource	yara_rule
sample	RANSOM_mountlocker

Files

4a5ac3c6f8383cc33c795804ba5f7f5553c029bbb4a6d28f1e4d8fb5107902c1
.exe windows x64

608bd80057d3a5e8811535ac9a9eb381

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

ReleaseSemaphore
WaitForSingleObject
GetTickCount64
SetEvent
CreateThread
CreateSemaphoreA
CreateEventA
DeviceIoControl
SetFileAttributesW
lstrcmpiW
TerminateThread
ResetEvent
ReadFile
GetFileSizeEx
TlsSetValue
SetEndOfFile
SetFileInformationByHandle
SetFilePointerEx
TlsGetValue
GetDriveTypeW
GetCommandLineW
ExitProcess
GetCurrentProcess
lstrlenA
TlsAlloc
GetComputerNameA
TerminateProcess
OpenProcess
lstrcmpiA
GetModuleFileNameW
GetTempPathW
CreateProcessW
GetSystemInfo
GetComputerNameW
GlobalMemoryStatus
DeleteFileW
CopyFileW
GetConsoleScreenBufferInfo
EnterCriticalSection
GetStdHandle
LeaveCriticalSection
InitializeCriticalSection
WriteConsoleW
DeleteCriticalSection
SetConsoleCursorPosition
AllocConsole
QueryPerformanceCounter
QueryPerformanceFrequency
GetTickCount
Sleep
WideCharToMultiByte
GetCurrentProcessId
HeapReAlloc
SetLastError
CloseHandle
CreateFileW
WriteFile
GetLastError
FindClose
FindNextFileW
HeapFree
FindFirstFileW
GetVolumeInformationW
lstrcpyW
GetProcessHeap
HeapAlloc
lstrcatW
lstrlenW
SetErrorMode
RtlVirtualUnwind

advapi32

LookupAccountSidW
GetTokenInformation
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
EnumServicesStatusA
CreateServiceW
CloseServiceHandle
OpenSCManagerW
GetUserNameW
DeleteService
ControlService
StartServiceW
QueryServiceStatusEx
OpenServiceA
CryptDestroyKey
CryptAcquireContextW
CryptEncrypt
CryptImportKey
CryptReleaseContext
OpenSCManagerA

ole32

CoCreateInstance
CoInitializeEx
CoSetProxyBlanket
CoInitializeSecurity

msvcrt

_vsnwprintf
memset
feof
fgetws
_wfopen
fclose
memcpy
_getch

mpr

WNetCancelConnection2W
WNetOpenEnumW
WNetCloseEnum
WNetEnumResourceW
WNetAddConnection2W

shell32

CommandLineToArgvW
ord680

shlwapi

StrCmpNIW
StrStrIW
StrCmpIW
StrChrW
StrStrIA
SHRegSetUSValueW

user32

wsprintfW

oleaut32

SysFreeString
SysAllocString

activeds

ord9

netapi32

NetShareEnum
NetGetJoinInformation
NetApiBufferFree
NetGetDCName

ntdll

RtlGetVersion
RtlGetNativeSystemInformation
ZwQuerySystemInformation

Sections

.text
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

bss
Size: - Virtual size: 136B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 888B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 212B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

608bd80057d3a5e8811535ac9a9eb381

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

ole32

msvcrt

mpr

shell32

shlwapi

user32

oleaut32

activeds

netapi32

ntdll

Sections

.text Size: 26KB - Virtual size: 26KB

bss Size: - Virtual size: 136B

.rdata Size: 21KB - Virtual size: 20KB

.data Size: 16KB - Virtual size: 17KB

.pdata Size: 1024B - Virtual size: 888B

.reloc Size: 512B - Virtual size: 212B

.text
Size: 26KB - Virtual size: 26KB

bss
Size: - Virtual size: 136B

.rdata
Size: 21KB - Virtual size: 20KB

.data
Size: 16KB - Virtual size: 17KB

.pdata
Size: 1024B - Virtual size: 888B

.reloc
Size: 512B - Virtual size: 212B