General
-
Target
d01048c32a640bba23ed9dfdadd255f225fa5c68ad690e00221500949333ae97
-
Size
981KB
-
Sample
240309-n8qxksfd93
-
MD5
6a72fe78139b79885be94f4bad7edbb8
-
SHA1
77948ecf0a7114b44d57d51bcea8ecc63263f632
-
SHA256
d01048c32a640bba23ed9dfdadd255f225fa5c68ad690e00221500949333ae97
-
SHA512
43e33153ccfcc76815ddecc43c19714d957aac1dedbd192748f25d86bf096a556a3f4a589e0b7f8f3fa3ee34ab6d75cac49539839ec195396f5d0de84b2b357d
-
SSDEEP
6144:getwmCnyadCadladGadkad6gadlJad0adZjHad/:rtqyacaHaMa+aEgaXJaqaLjHaR
Score
10/10
Malware Config
Extracted
Path
C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\RecoveryManual.html
Ransom Note
<html>
<head>
<title>RECOVERY MANUAL</title>
</head>
<body>
<h1>Your ClientId:</h1>
<b>
<pre>
92de476f40844b5ed6b3f2599f604fc17b229c7921c59d634fbff72b1f81f64e
</pre>
</b>
<hr/>
<b>/!\ YOUR NETWORK HAS BEEN HACKED /!\<br>
All your important files have been encrypted!</b><br>
<hr/>
Your files are safe! Only encrypted.<br><br>
ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br>
WILL PERMANENTLY CORRUPT IT.<br>
DO NOT MODIFY ENCRYPTED FILES.<br>
DO NOT RENAME ENCRYPTED FILES.<br><br>
No software available on internet can help you. We are the only ones able to<br>
solve your problem.<br><br>
You can send us 2-3 files and we will decrypt it for free<br>
to prove we are able to give your files back.<br><br>
Also we gathered highly confidential/personal data from your network. These data are currently stored on<br>
a private server. This server will be immediately destroyed after your payment.<br>
If you won't pay, we will release your data to public or reseller.<br>
So you can expect your data to be published or improperly used in the near future.<br>
In this case you will face all legal and reputational consequences of the leak.<br>
We only desire to get a ransom and we don't aim to damage your reputation or destroy<br>
your business.<br><br>
<hr/>
<b>Contact us to discuss your next step.</b><br><br>
<a href="http://54rz3un5etl3wxc4ckffvnlwleg5s3d4fexv4pir6qacedubmgi7knqd.onion/?cid=92de476f40844b5ed6b3f2599f604fc17b229c7921c59d634fbff72b1f81f64e">http://54rz3un5etl3wxc4ckffvnlwleg5s3d4fexv4pir6qacedubmgi7knqd.onion/?cid=92de476f40844b5ed6b3f2599f604fc17b229c7921c59d634fbff72b1f81f64e</a><br>
* Password field could be blank <br><br>
* Note that this server is only available via Tor browser only<br><br>
Follow the instructions to open the link:<br>
1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br>
2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br>
3. Now you have Tor browser. In the Tor Browser open "http://54rz3un5etl3wxc4ckffvnlwleg5s3d4fexv4pir6qacedubmgi7knqd.onion/?cid=92de476f40844b5ed6b3f2599f604fc17b229c7921c59d634fbff72b1f81f64e". <br>
4. Start a chat and follow the further instructions. (Password field should be empty for the first login). <br><br>
<hr/>
Please note, sometimes our support is away from keyboard, but we will reply shortly.<br>
Kindly advise you to contact us as soon as possible.<br></b><br>
</body>
</html>
Extracted
Path
C:\Recovery\WindowsRE\RecoveryManual.html
Ransom Note
<html>
<head>
<title>RECOVERY MANUAL</title>
</head>
<body>
<h1>Your ClientId:</h1>
<b>
<pre>
92de476f40844b5ed6b3f2599f604fc16a27997e24dd976c4fbff72b1f81f646
</pre>
</b>
<hr/>
<b>/!\ YOUR NETWORK HAS BEEN HACKED /!\<br>
All your important files have been encrypted!</b><br>
<hr/>
Your files are safe! Only encrypted.<br><br>
ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br>
WILL PERMANENTLY CORRUPT IT.<br>
DO NOT MODIFY ENCRYPTED FILES.<br>
DO NOT RENAME ENCRYPTED FILES.<br><br>
No software available on internet can help you. We are the only ones able to<br>
solve your problem.<br><br>
You can send us 2-3 files and we will decrypt it for free<br>
to prove we are able to give your files back.<br><br>
Also we gathered highly confidential/personal data from your network. These data are currently stored on<br>
a private server. This server will be immediately destroyed after your payment.<br>
If you won't pay, we will release your data to public or reseller.<br>
So you can expect your data to be published or improperly used in the near future.<br>
In this case you will face all legal and reputational consequences of the leak.<br>
We only desire to get a ransom and we don't aim to damage your reputation or destroy<br>
your business.<br><br>
<hr/>
<b>Contact us to discuss your next step.</b><br><br>
<a href="http://54rz3un5etl3wxc4ckffvnlwleg5s3d4fexv4pir6qacedubmgi7knqd.onion/?cid=92de476f40844b5ed6b3f2599f604fc16a27997e24dd976c4fbff72b1f81f646">http://54rz3un5etl3wxc4ckffvnlwleg5s3d4fexv4pir6qacedubmgi7knqd.onion/?cid=92de476f40844b5ed6b3f2599f604fc16a27997e24dd976c4fbff72b1f81f646</a><br>
* Password field could be blank <br><br>
* Note that this server is only available via Tor browser only<br><br>
Follow the instructions to open the link:<br>
1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br>
2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br>
3. Now you have Tor browser. In the Tor Browser open "http://54rz3un5etl3wxc4ckffvnlwleg5s3d4fexv4pir6qacedubmgi7knqd.onion/?cid=92de476f40844b5ed6b3f2599f604fc16a27997e24dd976c4fbff72b1f81f646". <br>
4. Start a chat and follow the further instructions. (Password field should be empty for the first login). <br><br>
<hr/>
Please note, sometimes our support is away from keyboard, but we will reply shortly.<br>
Kindly advise you to contact us as soon as possible.<br></b><br>
</body>
</html>
Targets
-
-
Target
d01048c32a640bba23ed9dfdadd255f225fa5c68ad690e00221500949333ae97
-
Size
981KB
-
MD5
6a72fe78139b79885be94f4bad7edbb8
-
SHA1
77948ecf0a7114b44d57d51bcea8ecc63263f632
-
SHA256
d01048c32a640bba23ed9dfdadd255f225fa5c68ad690e00221500949333ae97
-
SHA512
43e33153ccfcc76815ddecc43c19714d957aac1dedbd192748f25d86bf096a556a3f4a589e0b7f8f3fa3ee34ab6d75cac49539839ec195396f5d0de84b2b357d
-
SSDEEP
6144:getwmCnyadCadladGadkad6gadlJad0adZjHad/:rtqyacaHaMa+aEgaXJaqaLjHaR
Score10/10-
MountLocker Ransomware
Ransomware family first seen in late 2020, which threatens to leak files if ransom is not paid.
-
Deletes itself
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-