Overview

overview

10

Static

static

10

c09b509699...70.dll

windows7-x64

10

c09b509699...70.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c09b509699aeef71f3e205d53c5f4ff71cb48570.rl

  • Size

    77KB

  • Sample

    230223-tg165agd73

  • MD5

    0aacf2c41ba9b872a52055ffcaeaef15

  • SHA1

    c09b509699aeef71f3e205d53c5f4ff71cb48570

  • SHA256

    31630d16f4564c7a214a206a58f60b7623cd1b3abb823d10ed50aa077ca33585

  • SHA512

    d259de51d22d72d27d5947530317661b97ba8fcc36e7a2ad4835e98bc311ef1aa5964f939660733171934f6aefa82d8b76a6f9f04137e1aeca63d592f0fb26ec

  • SSDEEP

    1536:rADwfmySY6FIsr4XSZ32tcOGwpin2NI2F4cd:UDwTF6+srGi32tcOGwpin2NMcd

Score
10/10
mountlockerransomware

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\RecoveryManual.html

Ransom Note
<html> <head> <title>RECOVERY MANUAL</title> </head> <body> <h1>Your ClientId:</h1> <b> <pre> d11ebd6225c2dd096733ff8dad28b64333d3957fd7b47717abe00375993d6d61 </pre> </b> <hr/> /!\ YOUR COMPANY' NETWORK HAS BEEN HACKED /!\ <br> All your important documents have been encrypted and transferred to our premises!</b><br> <hr/> ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE WILL PERMANENTLY CORRUPT IT.<br> DO NOT MODIFY ENCRYPTED FILES.<br> DO NOT RENAME ENCRYPTED FILES.<br> However there is a solution for your problem!<br> We can support you with your data decryption for a monetary reward.<br> Also we will destroy your private data from our premises.<br> And we can prove our decryption capabilities by decrypting couple of your files free of charge.<br> <br> Here are the next steps to get your valuable data back and get it wiped out from our premises:<br> <a href="http://qiludmxlqqotacf62iycexcohbka4ezresf5jmwdoh7iyk3tgguzaaqd.onion/?cid=d11ebd6225c2dd096733ff8dad28b64333d3957fd7b47717abe00375993d6d61">http://qiludmxlqqotacf62iycexcohbka4ezresf5jmwdoh7iyk3tgguzaaqd.onion/?cid=d11ebd6225c2dd096733ff8dad28b64333d3957fd7b47717abe00375993d6d61</a><br> * Note that you need installed Tor Browser to open this kind of links.<br><br> Follow the instructions to install/run Tor Browser:<br> 1. Go to TOR Project website https://www.torproject.org using your usual browser (Chrome, Firefox, Internet Explorer or Edge)<br> 2. Click "Download Tor Browser" and pick right version for your Operation System (this is Windows in 99.9% of cases)<br> 3. Download and Install Tor Browser<br> 4. After installation finished, click on "Tor Browser" link from your Desktop<br> 5. By using Tor Browser visit <a href="http://qiludmxlqqotacf62iycexcohbka4ezresf5jmwdoh7iyk3tgguzaaqd.onion/?cid=d11ebd6225c2dd096733ff8dad28b64333d3957fd7b47717abe00375993d6d61">http://qiludmxlqqotacf62iycexcohbka4ezresf5jmwdoh7iyk3tgguzaaqd.onion/?cid=d11ebd6225c2dd096733ff8dad28b64333d3957fd7b47717abe00375993d6d61</a><br> 6. Copy your client id from the top of this document and paste it into Authorization window if requested <br> 7. This will start a chat with our security experts.<br> Please note, sometimes our team is away from keyboard, but make sure they will reply you back as soon as possible.<br> Also, we kindly request you to contact with us as soon as possible.<br> We will start publishing your private data to the Internet if you don't get in touch with us within next few days.<br> </body> </html>

Extracted

Path

C:\Users\Admin\Desktop\RecoveryManual.html

Family

mountlocker

Ransom Note
Your ClientId: /!\ YOUR COMPANY' NETWORK HAS BEEN HACKED /!\ All your important documents have been encrypted and transferred to our premises! ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE WILL PERMANENTLY CORRUPT IT. DO NOT MODIFY ENCRYPTED FILES. DO NOT RENAME ENCRYPTED FILES. However there is a solution for your problem! We can support you with your data decryption for a monetary reward. Also we will destroy your private data from our premises. And we can prove our decryption capabilities by decrypting couple of your files free of charge. Here are the next steps to get your valuable data back and get it wiped out from our premises: http://qiludmxlqqotacf62iycexcohbka4ezresf5jmwdoh7iyk3tgguzaaqd.onion/?cid=d11ebd6225c2dd096733ff8dad28b64333d3957fd7b47717abe00375993d6d61 * Note that you need installed Tor Browser to open this kind of links. Follow the instructions to install/run Tor Browser: 1. Go to TOR Project website https://www.torproject.org using your usual browser (Chrome, Firefox, Internet Explorer or Edge) 2. Click "Download Tor Browser" and pick right version for your Operation System (this is Windows in 99.9% of cases) 3. Download and Install Tor Browser 4. After installation finished, click on "Tor Browser" link from your Desktop 5. By using Tor Browser visit http://qiludmxlqqotacf62iycexcohbka4ezresf5jmwdoh7iyk3tgguzaaqd.onion/?cid=d11ebd6225c2dd096733ff8dad28b64333d3957fd7b47717abe00375993d6d61 6. Copy your client id from the top of this document and paste it into Authorization window if requested 7. This will start a chat with our security experts. Please note, sometimes our team is away from keyboard, but make sure they will reply you back as soon as possible. Also, we kindly request you to contact with us as soon as possible. We will start publishing your private data to the Internet if you don't get in touch with us within next few days.
URLs

http://qiludmxlqqotacf62iycexcohbka4ezresf5jmwdoh7iyk3tgguzaaqd.onion/?cid=d11ebd6225c2dd096733ff8dad28b64333d3957fd7b47717abe00375993d6d61

Extracted

Path

C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\RecoveryManual.html

Ransom Note
<html> <head> <title>RECOVERY MANUAL</title> </head> <body> <h1>Your ClientId:</h1> <b> <pre> d11ebd6225c2dd096733ff8dad28b64331cd8f65c4ab740fabe00375993d6d70 </pre> </b> <hr/> /!\ YOUR COMPANY' NETWORK HAS BEEN HACKED /!\ <br> All your important documents have been encrypted and transferred to our premises!</b><br> <hr/> ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE WILL PERMANENTLY CORRUPT IT.<br> DO NOT MODIFY ENCRYPTED FILES.<br> DO NOT RENAME ENCRYPTED FILES.<br> However there is a solution for your problem!<br> We can support you with your data decryption for a monetary reward.<br> Also we will destroy your private data from our premises.<br> And we can prove our decryption capabilities by decrypting couple of your files free of charge.<br> <br> Here are the next steps to get your valuable data back and get it wiped out from our premises:<br> <a href="http://qiludmxlqqotacf62iycexcohbka4ezresf5jmwdoh7iyk3tgguzaaqd.onion/?cid=d11ebd6225c2dd096733ff8dad28b64331cd8f65c4ab740fabe00375993d6d70">http://qiludmxlqqotacf62iycexcohbka4ezresf5jmwdoh7iyk3tgguzaaqd.onion/?cid=d11ebd6225c2dd096733ff8dad28b64331cd8f65c4ab740fabe00375993d6d70</a><br> * Note that you need installed Tor Browser to open this kind of links.<br><br> Follow the instructions to install/run Tor Browser:<br> 1. Go to TOR Project website https://www.torproject.org using your usual browser (Chrome, Firefox, Internet Explorer or Edge)<br> 2. Click "Download Tor Browser" and pick right version for your Operation System (this is Windows in 99.9% of cases)<br> 3. Download and Install Tor Browser<br> 4. After installation finished, click on "Tor Browser" link from your Desktop<br> 5. By using Tor Browser visit <a href="http://qiludmxlqqotacf62iycexcohbka4ezresf5jmwdoh7iyk3tgguzaaqd.onion/?cid=d11ebd6225c2dd096733ff8dad28b64331cd8f65c4ab740fabe00375993d6d70">http://qiludmxlqqotacf62iycexcohbka4ezresf5jmwdoh7iyk3tgguzaaqd.onion/?cid=d11ebd6225c2dd096733ff8dad28b64331cd8f65c4ab740fabe00375993d6d70</a><br> 6. Copy your client id from the top of this document and paste it into Authorization window if requested <br> 7. This will start a chat with our security experts.<br> Please note, sometimes our team is away from keyboard, but make sure they will reply you back as soon as possible.<br> Also, we kindly request you to contact with us as soon as possible.<br> We will start publishing your private data to the Internet if you don't get in touch with us within next few days.<br> </body> </html>

Extracted

Path

C:\Users\Admin\Desktop\RecoveryManual.html

Family

mountlocker

Ransom Note
Your ClientId: /!\ YOUR COMPANY' NETWORK HAS BEEN HACKED /!\ All your important documents have been encrypted and transferred to our premises! ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE WILL PERMANENTLY CORRUPT IT. DO NOT MODIFY ENCRYPTED FILES. DO NOT RENAME ENCRYPTED FILES. However there is a solution for your problem! We can support you with your data decryption for a monetary reward. Also we will destroy your private data from our premises. And we can prove our decryption capabilities by decrypting couple of your files free of charge. Here are the next steps to get your valuable data back and get it wiped out from our premises: http://qiludmxlqqotacf62iycexcohbka4ezresf5jmwdoh7iyk3tgguzaaqd.onion/?cid=d11ebd6225c2dd096733ff8dad28b64331cd8f65c4ab740fabe00375993d6d70 * Note that you need installed Tor Browser to open this kind of links. Follow the instructions to install/run Tor Browser: 1. Go to TOR Project website https://www.torproject.org using your usual browser (Chrome, Firefox, Internet Explorer or Edge) 2. Click "Download Tor Browser" and pick right version for your Operation System (this is Windows in 99.9% of cases) 3. Download and Install Tor Browser 4. After installation finished, click on "Tor Browser" link from your Desktop 5. By using Tor Browser visit http://qiludmxlqqotacf62iycexcohbka4ezresf5jmwdoh7iyk3tgguzaaqd.onion/?cid=d11ebd6225c2dd096733ff8dad28b64331cd8f65c4ab740fabe00375993d6d70 6. Copy your client id from the top of this document and paste it into Authorization window if requested 7. This will start a chat with our security experts. Please note, sometimes our team is away from keyboard, but make sure they will reply you back as soon as possible. Also, we kindly request you to contact with us as soon as possible. We will start publishing your private data to the Internet if you don't get in touch with us within next few days.
URLs

http://qiludmxlqqotacf62iycexcohbka4ezresf5jmwdoh7iyk3tgguzaaqd.onion/?cid=d11ebd6225c2dd096733ff8dad28b64331cd8f65c4ab740fabe00375993d6d70

Targets

    • Target

      c09b509699aeef71f3e205d53c5f4ff71cb48570.rl

    • Size

      77KB

    • MD5

      0aacf2c41ba9b872a52055ffcaeaef15

    • SHA1

      c09b509699aeef71f3e205d53c5f4ff71cb48570

    • SHA256

      31630d16f4564c7a214a206a58f60b7623cd1b3abb823d10ed50aa077ca33585

    • SHA512

      d259de51d22d72d27d5947530317661b97ba8fcc36e7a2ad4835e98bc311ef1aa5964f939660733171934f6aefa82d8b76a6f9f04137e1aeca63d592f0fb26ec

    • SSDEEP

      1536:rADwfmySY6FIsr4XSZ32tcOGwpin2NI2F4cd:UDwTF6+srGi32tcOGwpin2NMcd

    Score
    10/10
    mountlockerransomware

    • MountLocker Ransomware

      Ransomware family first seen in late 2020, which threatens to leak files if ransom is not paid.

      ransomwaremountlocker

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Deletes itself

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks