- Gn4Hl1548897076 - New Mongolock Ransomware Attacking Database to Deleteing file

Newly discovered a distractive Ransomware Mongolock targets the databases & deleting files along with encrypting the files in order to demand the ransom amount.

Ransomware attackers are nowadays dramatically increasing and the attackers are using different techniques to encrypt the files and evade the detection of with the ultimate motivation to earn revenue.

Unlike traditional ransomware attack, Mongolock Ransomware not only encrypts the compromised files but also deleting the ’s file in local drive and back up the database to demand ransom amount.

During infection session, once the file will be executed it checks for user’s folders and specific locations such as Documents, Desktop, Recent, Favorites, Music and Video.

In this case, Mongolock Ransomware using ‘format.com’, a legitimate command formatting the folders and drives in order to delete the compromised system files.

- 1 - New Mongolock Ransomware Attacking Database to Deleteing file

Mongolock Ransomware Infection & Deleting Process

Once the Mangolock ransomware successfully launched the it executed various command for each folder in order to perform a format operation.

  • “C:Windowssystem32cmd.exe” /c del C:UsersPublicDesktop* /F /Q
  • “C:Windowssystem32cmd.exe” /c del C:UsersUserVideos* /F /Q
  • “C:Windowssystem32cmd.exe” /c del D:\* /F /Q
  • “C:Windowssystem32cmd.exe” /c format D: /fs:ntfs /q /y
  • “C:Windowssystem32cmd.exe” /c del C:UsersUserDesktop* /F /Q
  • “C:Windowssystem32cmd.exe” /c del C:UsersUserMusic* /F /Q
  • “C:Windowssystem32cmd.exe” /c del C:UsersUserFavorites* /F /Q
  • “C:Windowssystem32cmd.exe” /c del C:UsersUserDocuments* /F /Q

Before performing a formatting process, ransomware collect and send all the victims information into the attacker by establish the connection with Command & control server.

- 2 2 - New Mongolock Ransomware Attacking Database to Deleteing file
 Command to delete Desktop files
- 3 1 - New Mongolock Ransomware Attacking Database to Deleteing file
Command to format local disk drive

According to Quick heal Research, Though we have seen the connectivity of the ransomware to the CnC server, we have not seen any being backed up on the server, hence, users are advised not to pay any ransom as the authors will not be able to restore the .

Once the ransomware complete its operation then finally it drops the ransomware note that contain the detailed information that says “victim’s database and files back up on their secured server. “

- 6 1 - New Mongolock Ransomware Attacking Database to Deleteing file

Warning message say that the victims need to pay the 0.1 bitcoin to the wallet that they mention in the ransomware notes and the backed up data will be return to the victim within 24 hours once the payment will be made from victims end.

You can follow us on LinkedinTwitterFacebook for daily updates also you can take the Best Cybersecurity courses online to keep your self-updated.

Also Read:Ransomware Attack Response and Mitigation Checklist

Source link

No tags for this post.


Please enter your comment!
Please enter your name here