SYMBOLCOMMON_NAMEaka. SYNONYMS
win.mount_locker (Back to overview)

Mount Locker


There is no description at this point.

References
2021-08-04CrowdStrikeFalcon OverWatch Team, CrowdStrike Intelligence Team, CrowdStrike IR
@online{team:20210804:prophet:e6e6a99, author = {Falcon OverWatch Team and CrowdStrike Intelligence Team and CrowdStrike IR}, title = {{PROPHET SPIDER Exploits Oracle WebLogic to Facilitate Ransomware Activity}}, date = {2021-08-04}, organization = {CrowdStrike}, url = {https://www.crowdstrike.com/blog/prophet-spider-exploits-oracle-weblogic-to-facilitate-ransomware-activity/}, language = {English}, urldate = {2021-09-02} } PROPHET SPIDER Exploits Oracle WebLogic to Facilitate Ransomware Activity
Cobalt Strike Egregor Mount Locker
2021-08-04kienmanowar Blogm4n0w4r, Tran Trung Kien
@online{m4n0w4r:20210804:quicknote:791df11, author = {m4n0w4r and Tran Trung Kien}, title = {{[QuickNote] MountLocker – Some pseudo-code snippets}}, date = {2021-08-04}, organization = {kienmanowar Blog}, url = {https://kienmanowar.wordpress.com/2021/08/04/quicknote-mountlocker-some-pseudo-code-snippets/}, language = {English}, urldate = {2021-09-09} } [QuickNote] MountLocker – Some pseudo-code snippets
Mount Locker
2021-07-14Intel 471Intel 471
@online{471:20210714:how:0cf4b03, author = {Intel 471}, title = {{How cybercriminals create turbulence for the transportation industry}}, date = {2021-07-14}, organization = {Intel 471}, url = {https://intel471.com/blog/how-cybercriminals-create-turbulence-for-the-transportation-industry}, language = {English}, urldate = {2021-07-29} } How cybercriminals create turbulence for the transportation industry
Mount Locker Nefilim
2021-06-23SymantecThreat Hunter Team
@online{team:20210623:ransomware:d88988e, author = {Threat Hunter Team}, title = {{Ransomware: Growing Number of Attackers Using Virtual Machines}}, date = {2021-06-23}, organization = {Symantec}, url = {https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ransomware-virtual-machines}, language = {English}, urldate = {2021-06-25} } Ransomware: Growing Number of Attackers Using Virtual Machines
Mount Locker
2021-05-23Chuongdong blogChuong Dong
@online{dong:20210523:mountlocker:4b3d011, author = {Chuong Dong}, title = {{MountLocker Ransomware}}, date = {2021-05-23}, organization = {Chuongdong blog}, url = {https://chuongdong.com/reverse%20engineering/2021/05/23/MountLockerRansomware/}, language = {English}, urldate = {2021-06-16} } MountLocker Ransomware
Mount Locker
2021-05-18Github (Finch4)Finch
@online{finch:20210518:analysis:434b2ec, author = {Finch}, title = {{Analysis of MountLocker}}, date = {2021-05-18}, organization = {Github (Finch4)}, url = {https://github.com/Finch4/Malware-Analysis-Reports/tree/main/MountLocker}, language = {English}, urldate = {2021-05-26} } Analysis of MountLocker
Mount Locker
2021-05-10DarkTracerDarkTracer
@online{darktracer:20210510:intelligence:b9d1c3f, author = {DarkTracer}, title = {{Intelligence Report on Ransomware Gangs on the DarkWeb: List of victim organizations attacked by ransomware gangs released on the DarkWeb}}, date = {2021-05-10}, organization = {DarkTracer}, url = {https://docs.google.com/spreadsheets/d/1MI8Z2tBhmqQ5X8Wf_ozv3dVjz5sJOs-3}, language = {English}, urldate = {2021-05-13} } Intelligence Report on Ransomware Gangs on the DarkWeb: List of victim organizations attacked by ransomware gangs released on the DarkWeb
RansomEXX Avaddon Babuk Clop Conti Cuba DarkSide DoppelPaymer Egregor Hades LockBit Mailto Maze MedusaLocker Mespinoza Mount Locker Nefilim Nemty Pay2Key PwndLocker RagnarLocker Ragnarok RansomEXX REvil Sekhmet SunCrypt ThunderX
2021-04-23GuidePoint SecurityDrew Schmitt
@online{schmitt:20210423:mount:ccc9271, author = {Drew Schmitt}, title = {{Mount Locker Ransomware Steps up Counter-IR Capabilities, Hindering Efforts for Detection, Response and Investigation}}, date = {2021-04-23}, organization = {GuidePoint Security}, url = {https://www.guidepointsecurity.com/mount-locker-ransomware-steps-up-counter-ir-capabilities/}, language = {English}, urldate = {2021-04-28} } Mount Locker Ransomware Steps up Counter-IR Capabilities, Hindering Efforts for Detection, Response and Investigation
Mount Locker
2021-03-31SophosMichael Heller
@online{heller:20210331:sophos:43ef878, author = {Michael Heller}, title = {{Sophos MTR in Real Time: What is Astro Locker Team?}}, date = {2021-03-31}, organization = {Sophos}, url = {https://news.sophos.com/en-us/2021/03/31/sophos-mtr-in-real-time-what-is-astro-locker-team/}, language = {English}, urldate = {2021-04-06} } Sophos MTR in Real Time: What is Astro Locker Team?
Mount Locker
2021-02-23CrowdStrikeCrowdStrike
@techreport{crowdstrike:20210223:2021:bf5bc4f, author = {CrowdStrike}, title = {{2021 Global Threat Report}}, date = {2021-02-23}, institution = {CrowdStrike}, url = {https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf}, language = {English}, urldate = {2021-02-25} } 2021 Global Threat Report
RansomEXX Amadey Anchor Avaddon BazarBackdoor Clop Cobalt Strike Conti Cutwail DanaBot DarkSide DoppelPaymer Dridex Egregor Emotet Hakbit IcedID JSOutProx KerrDown LockBit Mailto Maze MedusaLocker Mespinoza Mount Locker NedDnLoader Nemty Pay2Key PlugX Pushdo PwndLocker PyXie QakBot Quasar RAT RagnarLocker Ragnarok RansomEXX REvil Ryuk Sekhmet ShadowPad SmokeLoader Snake SUNBURST SunCrypt TEARDROP TrickBot WastedLocker Winnti Zloader KNOCKOUT SPIDER OUTLAW SPIDER RIDDLE SPIDER SOLAR SPIDER VIKING SPIDER
2020-12-23Dissecting MalwareMarius Genheimer
@online{genheimer:20201223:between:e482082, author = {Marius Genheimer}, title = {{Between a rock and a hard place - Exploring Mount Locker Ransomware}}, date = {2020-12-23}, organization = {Dissecting Malware}, url = {https://dissectingmalwa.re/between-a-rock-and-a-hard-place-exploring-mount-locker-ransomware.html}, language = {English}, urldate = {2021-01-21} } Between a rock and a hard place - Exploring Mount Locker Ransomware
Mount Locker
2020-12-11BlackberryBlackBerry Research and Intelligence team
@online{team:20201211:mountlocker:9c495cb, author = {BlackBerry Research and Intelligence team}, title = {{MountLocker Ransomware-as-a-Service Offers Double Extortion Capabilities to Affiliates}}, date = {2020-12-11}, organization = {Blackberry}, url = {https://blogs.blackberry.com/en/2020/12/mountlocker-ransomware-as-a-service-offers-double-extortion-capabilities-to-affiliates}, language = {English}, urldate = {2020-12-14} } MountLocker Ransomware-as-a-Service Offers Double Extortion Capabilities to Affiliates
Cobalt Strike Mount Locker
2020-11-19Bleeping ComputerLawrence Abrams
@online{abrams:20201119:mount:0294998, author = {Lawrence Abrams}, title = {{Mount Locker ransomware now targets your TurboTax tax returns}}, date = {2020-11-19}, organization = {Bleeping Computer}, url = {https://www.bleepingcomputer.com/news/security/mount-locker-ransomware-now-targets-your-turbotax-tax-returns/}, language = {English}, urldate = {2020-11-23} } Mount Locker ransomware now targets your TurboTax tax returns
Mount Locker
2020-11-13Bleeping ComputerSergiu Gatlan
@online{gatlan:20201113:biotech:cbe6093, author = {Sergiu Gatlan}, title = {{Biotech research firm Miltenyi Biotec hit by ransomware, data leaked}}, date = {2020-11-13}, organization = {Bleeping Computer}, url = {https://www.bleepingcomputer.com/news/security/biotech-research-firm-miltenyi-biotec-hit-by-ransomware-data-leaked/}, language = {English}, urldate = {2020-11-19} } Biotech research firm Miltenyi Biotec hit by ransomware, data leaked
Mount Locker
2020-09-24Bleeping ComputerLawrence Abrams
@online{abrams:20200924:mount:0456f2a, author = {Lawrence Abrams}, title = {{Mount Locker ransomware joins the multi-million dollar ransom game}}, date = {2020-09-24}, organization = {Bleeping Computer}, url = {https://www.bleepingcomputer.com/news/security/mount-locker-ransomware-joins-the-multi-million-dollar-ransom-game/}, language = {English}, urldate = {2020-10-02} } Mount Locker ransomware joins the multi-million dollar ransom game
Mount Locker
Yara Rules
[TLP:WHITE] win_mount_locker_auto (20210616 | Detects win.mount_locker.)
rule win_mount_locker_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2021-06-10"
        version = "1"
        description = "Detects win.mount_locker."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mount_locker"
        malpedia_rule_date = "20210604"
        malpedia_hash = "be09d5d71e77373c0f538068be31a2ad4c69cfbd"
        malpedia_version = "20210616"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 4883f8ff 7436 488364242000 4c8d4c2468 448bc7 488bd3 }
            // n = 6, score = 300
            //   4883f8ff             | mov                 ecx, edi
            //   7436                 | dec                 eax
            //   488364242000         | lea                 ecx, dword ptr [0xb35]
            //   4c8d4c2468           | dec                 eax
            //   448bc7               | mov                 edx, ebx
            //   488bd3               | inc                 ecx

        $sequence_1 = { ff15???????? 8bd8 85c0 743b 488b4d6f 488d4567 c744243000010000 }
            // n = 7, score = 300
            //   ff15????????         |                     
            //   8bd8                 | jl                  0x3e3
            //   85c0                 | xor                 eax, eax
            //   743b                 | dec                 eax
            //   488b4d6f             | mov                 ebx, dword ptr [esp + 0x40]
            //   488d4567             | dec                 eax
            //   c744243000010000     | mov                 ebp, dword ptr [esp + 0x48]

        $sequence_2 = { ff15???????? 4c8d442458 ba28000000 488bc8 ff15???????? }
            // n = 5, score = 300
            //   ff15????????         |                     
            //   4c8d442458           | pslld               mm7, 7
            //   ba28000000           | psrld               xmm7, 0x19
            //   488bc8               | inc                 sp
            //   ff15????????         |                     

        $sequence_3 = { 397c2468 7507 b801000000 eb02 }
            // n = 4, score = 300
            //   397c2468             | dec                 ecx
            //   7507                 | div                 eax
            //   b801000000           | xorps               xmm0, xmm0
            //   eb02                 | dec                 eax

        $sequence_4 = { b905000000 ff15???????? 3d040000c0 7494 85c0 }
            // n = 5, score = 300
            //   b905000000           | inc                 ecx
            //   ff15????????         |                     
            //   3d040000c0           | cmp                 eax, 5
            //   7494                 | jne                 0x3ed
            //   85c0                 | dec                 esp

        $sequence_5 = { ff15???????? 85db 740d 397c2468 }
            // n = 4, score = 300
            //   ff15????????         |                     
            //   85db                 | lea                 edx, dword ptr [esp + 0x30]
            //   740d                 | inc                 ebp
            //   397c2468             | lea                 eax, dword ptr [ecx + 0xc]

        $sequence_6 = { 40f6c602 7423 488b0d???????? 4885c9 }
            // n = 4, score = 300
            //   40f6c602             | lea                 ecx, dword ptr [ebx + 3]
            //   7423                 | lea                 edi, dword ptr [ebx + 8]
            //   488b0d????????       |                     
            //   4885c9               | xor                 ebx, ebx

        $sequence_7 = { ff15???????? 85c0 7428 b9f5ffffff ff15???????? 488905???????? }
            // n = 6, score = 300
            //   ff15????????         |                     
            //   85c0                 | dec                 eax
            //   7428                 | lea                 ecx, dword ptr [esp + 0x20]
            //   b9f5ffffff           | inc                 ecx
            //   ff15????????         |                     
            //   488905????????       |                     

        $sequence_8 = { 488bf0 4883f8ff 7436 488364242000 4c8d4c2468 448bc7 }
            // n = 6, score = 300
            //   488bf0               | mov                 ecx, edi
            //   4883f8ff             | jmp                 0x249
            //   7436                 | mov                 ecx, 2
            //   488364242000         | mov                 ecx, 0x3e8
            //   4c8d4c2468           | jmp                 0x258
            //   448bc7               | dec                 eax

        $sequence_9 = { 33d2 4889442420 ff15???????? 488b4d6f 8bd8 }
            // n = 5, score = 300
            //   33d2                 | inc                 ebx
            //   4889442420           | lea                 eax, dword ptr [eax + edi]
            //   ff15????????         |                     
            //   488b4d6f             | add                 eax, 0x61707865
            //   8bd8                 | add                 ebx, 0x3320646e

    condition:
        7 of them and filesize < 225280
}
Download all Yara Rules