Monday, May 5, 2025
HomeComputer SecurityAnnabelle & MBRLock Ransomware New Evolution that Directly Infecting Master Boot Record...

Annabelle & MBRLock Ransomware New Evolution that Directly Infecting Master Boot Record In Compromised Computers

Published on

SIEM as a Service

Follow Us on Google News

Annabelle & MBRLock ransomware new evolution that directly infecting the Windows computers Master Boot Record (MBR) which Prevent Operating system to loading and avoid the security scan.

None of the ransomware tool work Since the Operating system stop booting and this technique is kept increasing nowadays and this technique also used by PETYA ransomware last year.

Ransomware evolution is dramatically increasing nowadays and the authors are using various new tactics to bypass the security control and maintain its persistence.

- Advertisement - Google News

MBR infection is an indication of deep infection in terms of controlling the infected computers and maintains more persistence to do its further encryption operation.

A master boot record (often shortened as MBR) is a kind of boot sector stored on a hard disk drive or other storage devices that contain the necessary computer code to start the boot process.

MBR based Ransomware infection takes place when the user restarts the system once the ransomware copies the original MBR and overwrites it with its own malicious code.

Since the MBR executes every time a computer is started, an MBR infection can be extremely dangerous.

Annabelle & MBRLock Ransomware

Annabelle Infection with Master Boot Record

Annabelle ransomware is capable of destroying all the hard disk that connected with the computers by infecting the Master Boot Record.

After the infection, it attempts to disable the firewall and it is capable of terminates the list of processes including the security-related programs.

Initially, it spreading via spam email and connected USB drives and overwrites the MBR with its own code.

It calls a DLL CreateFileA to take over the infected systems physical drive where it will write  0x800 bytes on each physical drive.

According to QuickHeal Researchers, termination of this process will result in a termination of Windows as well. Calling RtlSetProcessIsCritical (1, 0, 0) will set the process as critical.Later it calls RtlSetProcessIs function.

Eventually, it calls shutdown.exe with parameter -r -f -t 0(r-shutdown& restart) to restart the system and -t  to force running applications.

Finally, once the system restarted then the Malware gets executed and encrypt the desk file and displays the ransom notes.

This Annabelle ransomware demand 0.1 Bitcoin as a ransom amount also it displays the countdown to pay the ransom amount and if it exceeds then the new screen will be displayed that is an indication of completely infection system unusable ever and it destroys all hard disk data.

MBRLock Infection with Master Boot Record

MBRLock initially discovered on Feb 2018 which is another ransomware that abuses the Master Boot Record of the victim’s computer.

It using createfile API  to read the physical drive Then it calls SetFilePointer and sets the offset to zero of the physical drive to access MBR.

It reads 0x200 bytes of the physical drive in memory and writes on another sector for restoring in future and replaces the original MBR with the malicious code.

Later malware writes the malicious code in zero offsets so malicious code executes every time when system reboot then malware calls ExitWindowEx API to restart the system.

Finally, it displays the ransom notes that says send 30 yuan to the 2055965068 qq address in order to get access to their computer again”.

Annabelle & MBRLock ransomware
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

Gunra Ransomware’s Double‑Extortion Playbook and Global Impact

Gunra Ransomware, has surfaced as a formidable threat in April 2025, targeting Windows systems...

Hackers Exploit 21 Apps to Take Full Control of E-Commerce Servers

Cybersecurity firm Sansec has uncovered a sophisticated supply chain attack that has compromised 21...

Hackers Target HR Departments With Fake Resumes to Spread More_eggs Malware

The financially motivated threat group Venom Spider, also tracked as TA4557, has shifted its...

RomCom RAT Targets UK Organizations Through Compromised Customer Feedback Portals

The Russian-based threat group RomCom, also known as Storm-0978, Tropical Scorpius, and Void Rabisu,...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Gunra Ransomware’s Double‑Extortion Playbook and Global Impact

Gunra Ransomware, has surfaced as a formidable threat in April 2025, targeting Windows systems...

NCSC Warns of Ransomware Attacks Targeting UK Organisations

National Cyber Security Centre (NCSC) has issued technical guidance following a series of cyber...

RansomHub Taps SocGholish: WebDAV & SCF Exploits Fuel Credential Heists

SocGholish, a notorious loader malware, has evolved into a critical tool for cybercriminals, often...