mountlocker | 6e5899337bc30f96ec69029fa90b0fae7da3595336397b6b6a393ef13279be0c

General

Target
2025-11-13_31695f4bd800846c7aa692065bbd14e1_elex_mountlocker
Size 41KB
Sample251113-raznlsvngs
SHA256 6e5899337bc30f96ec69029fa90b0fae7da3595336397b6b6a393ef13279be0c
MD5 31695f4bd800846c7aa692065bbd14e1
SHA1 745ce6408f88744a1a819cb0908a2b8b4c56ed0a
SHA512 657b6ee5d53ea7d27aa939c7a470e70c7de5d731e890d263d727700a10952124aabb0749fd7cf42eba10009fdd1865d6508138932f1b3e70248a2e74486ee865
SSDEEP 384:jcDg2ABm1Klb1IlTA05KcHh3zoK82uwxlkfvLoGdh1it6x0yq:jcDgPmS1IBdBsP2O3Lhdh1i
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Path

C:\Program Files\RecoveryManual.html

Ransom Note

<html> <head> <title>RECOVERY MANUAL</title> </head> <body> <h1>Your ClientId:</h1> <pre> aa0a8ea69e22c4a789b451ab4101d8502f8ab518dfaa05d2e00577a9cc00a15f </pre> <hr/> /!\ YOUR NETWORK HAS BEEN HACKED /!\ All your important files have been encrypted! <hr/> Your files are safe! Only encrypted. ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE WILL PERMANENTLY CORRUPT IT. DO NOT MODIFY ENCRYPTED FILES. DO NOT RENAME ENCRYPTED FILES. No software available on internet can help you. We are the only ones able to solve your problem. You can send us 2-3 files and we will decrypt it for free to prove we are able to give your files back. Also we gathered highly confidential/personal data from your network. These data are currently stored on a private server. This server will be immediately destroyed after your payment. If you won't pay, we will release your data to public or reseller. So you can expect your data to be published or improperly used in the near future. In this case you will face all legal and reputational consequences of the leak. We only desire to get a ransom and we don't aim to damage your reputation or destroy your business. <hr/> Contact us to discuss your next step. <a href="http://soxbhgx23tabwh2k447b2tljcu5tktdc2elmi2ls7huzntrhknygxsqd.onion/?cid=aa0a8ea69e22c4a789b451ab4101d8502f8ab518dfaa05d2e00577a9cc00a15f">http://soxbhgx23tabwh2k447b2tljcu5tktdc2elmi2ls7huzntrhknygxsqd.onion/?cid=aa0a8ea69e22c4a789b451ab4101d8502f8ab518dfaa05d2e00577a9cc00a15f</a> * Note that this server is only available via Tor browser only Follow the instructions to open the link: 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site. 2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it. 3. Now you have Tor browser. In the Tor Browser open "http://soxbhgx23tabwh2k447b2tljcu5tktdc2elmi2ls7huzntrhknygxsqd.onion/?cid=aa0a8ea69e22c4a789b451ab4101d8502f8ab518dfaa05d2e00577a9cc00a15f". 4. Start a chat and follow the further instructions. (Password field should be empty for the first login). <hr/> If you can`t use the above link, use the email: <a href="mailto:[email protected]">[email protected]</a> Please note, sometimes our support is away from keyboard, but we will reply shortly. Kindly advise you to contact us as soon as possible. </body> </html>

Emails

href="mailto:[email protected]">[email protected]</a>

Extracted

Path

C:\Program Files\RecoveryManual.html

Ransom Note

<html> <head> <title>RECOVERY MANUAL</title> </head> <body> <h1>Your ClientId:</h1> <pre> aa0a8ea69e22c4a789b451ab4101d850258da118c4a516c3e00577a9cc00a140 </pre> <hr/> /!\ YOUR NETWORK HAS BEEN HACKED /!\ All your important files have been encrypted! <hr/> Your files are safe! Only encrypted. ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE WILL PERMANENTLY CORRUPT IT. DO NOT MODIFY ENCRYPTED FILES. DO NOT RENAME ENCRYPTED FILES. No software available on internet can help you. We are the only ones able to solve your problem. You can send us 2-3 files and we will decrypt it for free to prove we are able to give your files back. Also we gathered highly confidential/personal data from your network. These data are currently stored on a private server. This server will be immediately destroyed after your payment. If you won't pay, we will release your data to public or reseller. So you can expect your data to be published or improperly used in the near future. In this case you will face all legal and reputational consequences of the leak. We only desire to get a ransom and we don't aim to damage your reputation or destroy your business. <hr/> Contact us to discuss your next step. <a href="http://soxbhgx23tabwh2k447b2tljcu5tktdc2elmi2ls7huzntrhknygxsqd.onion/?cid=aa0a8ea69e22c4a789b451ab4101d850258da118c4a516c3e00577a9cc00a140">http://soxbhgx23tabwh2k447b2tljcu5tktdc2elmi2ls7huzntrhknygxsqd.onion/?cid=aa0a8ea69e22c4a789b451ab4101d850258da118c4a516c3e00577a9cc00a140</a> * Note that this server is only available via Tor browser only Follow the instructions to open the link: 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site. 2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it. 3. Now you have Tor browser. In the Tor Browser open "http://soxbhgx23tabwh2k447b2tljcu5tktdc2elmi2ls7huzntrhknygxsqd.onion/?cid=aa0a8ea69e22c4a789b451ab4101d850258da118c4a516c3e00577a9cc00a140". 4. Start a chat and follow the further instructions. (Password field should be empty for the first login). <hr/> If you can`t use the above link, use the email: <a href="mailto:[email protected]">[email protected]</a> Please note, sometimes our support is away from keyboard, but we will reply shortly. Kindly advise you to contact us as soon as possible. </body> </html>

Emails

href="mailto:[email protected]">[email protected]</a>

Targets

- Target
  2025-11-13_31695f4bd800846c7aa692065bbd14e1_elex_mountlocker
- Size 41KB
- SHA256 6e5899337bc30f96ec69029fa90b0fae7da3595336397b6b6a393ef13279be0c
- MD5 31695f4bd800846c7aa692065bbd14e1
- SHA1 745ce6408f88744a1a819cb0908a2b8b4c56ed0a
- SHA512 657b6ee5d53ea7d27aa939c7a470e70c7de5d731e890d263d727700a10952124aabb0749fd7cf42eba10009fdd1865d6508138932f1b3e70248a2e74486ee865
- SSDEEP 384:jcDg2ABm1Klb1IlTA05KcHh3zoK82uwxlkfvLoGdh1it6x0yq:jcDgPmS1IBdBsP2O3Lhdh1i
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

defense_evasion discovery execution mountlocker ransomware
- MountLocker Ransomware
  Ransomware family first seen in late 2020, which threatens to leak files if ransom is not paid.
  ransomware mountlocker
- Mountlocker family
  mountlocker
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2