mountlocker | 85b53edb2e3476bdb29f98bd19c56baa0205e6620917e654cbe81c9745d6193d

Resubmissions

30-04-2024 05:29

240430-f6xncade75 10

11-04-2024 13:06

240411-qb4taafb9w 10

11-04-2024 12:33

240411-pq9seaeg2z 10

Sharing

Copy URL

Twitter E-mail

General

Target

ed6e7169456ef1f41f6a45812dda7d98_JaffaCakes118
Size

56KB
Sample

240411-qb4taafb9w
MD5

ed6e7169456ef1f41f6a45812dda7d98
SHA1

c82733e2d394b272db6cbf49aa8a1207c8d9fb87
SHA256

85b53edb2e3476bdb29f98bd19c56baa0205e6620917e654cbe81c9745d6193d
SHA512

0e7d3dbe68de4301501df68b1eeb36bf68ca3ea61091710352f68f09f8f9b8b96888ccb2419330b2fbd7b592bd98b583aaea818345c87d591b9b0a96845b8d87
SSDEEP

768:65h+QW4yKs5INTjabOSQwrPG12nFb5GnVWs6k:63XWNKQ2jnSQyNnFbgN

Score

10^/10

Malware Config

Targets

- Target
  
  ed6e7169456ef1f41f6a45812dda7d98_JaffaCakes118
- Size
  
  56KB
- MD5
  
  ed6e7169456ef1f41f6a45812dda7d98
- SHA1
  
  c82733e2d394b272db6cbf49aa8a1207c8d9fb87
- SHA256
  
  85b53edb2e3476bdb29f98bd19c56baa0205e6620917e654cbe81c9745d6193d
- SHA512
  
  0e7d3dbe68de4301501df68b1eeb36bf68ca3ea61091710352f68f09f8f9b8b96888ccb2419330b2fbd7b592bd98b583aaea818345c87d591b9b0a96845b8d87
- SSDEEP
  
  768:65h+QW4yKs5INTjabOSQwrPG12nFb5GnVWs6k:63XWNKQ2jnSQyNnFbgN
Score

10^/10

mountlocker ransomware spyware stealer
- MountLocker Ransomware
  Ransomware family first seen in late 2020, which threatens to leak files if ransom is not paid.
  ransomware mountlocker
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral10 behavioral11 behavioral12 behavioral13 behavioral14 behavioral15 behavioral16 behavioral2 behavioral3 behavioral4 behavioral5 behavioral6 behavioral7 behavioral8 behavioral9

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

MountLocker Ransomware

Reads user/profile data of web browsers

Drops desktop.ini file(s)

Enumerates connected drives

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16