Thursday, July 18, 2024
EHA

New Mongolock Ransomware Attacking Database to Encrypt & Deleting Files

Newly discovered a distractive Ransomware Mongolock targets the databases & deleting files along with encrypting the files in order to demand the ransom amount.

Ransomware attackers are nowadays dramatically increasing and the attackers are using different techniques to encrypt the files and evade the detection of security software with the ultimate motivation to earn revenue.

Unlike traditional ransomware attack, Mongolock Ransomware not only encrypts the compromised victim files but also deleting the victim’s file in local drive and back up the database to demand ransom amount.

During infection session, once the file will be executed it checks for user’s folders and specific locations such as Documents, Desktop, Recent, Favorites, Music and Video.

In this case, Mongolock Ransomware using ‘format.com’, a legitimate windows command formatting the folders and drives in order to delete the compromised system files.

Mongolock Ransomware Infection & Deleting Process

Once the Mangolock ransomware successfully launched the it executed various command for each folder in order to perform a format operation.

  • “C:\Windows\system32\cmd.exe” /c del C:\Users\Public\Desktop\* /F /Q
  • “C:\Windows\system32\cmd.exe” /c del C:\Users\User\Videos\* /F /Q
  • “C:\Windows\system32\cmd.exe” /c del D:\\* /F /Q
  • “C:\Windows\system32\cmd.exe” /c format D: /fs:ntfs /q /y
  • “C:\Windows\system32\cmd.exe” /c del C:\Users\User\Desktop\* /F /Q
  • “C:\Windows\system32\cmd.exe” /c del C:\Users\User\Music\* /F /Q
  • “C:\Windows\system32\cmd.exe” /c del C:\Users\User\Favorites\* /F /Q
  • “C:\Windows\system32\cmd.exe” /c del C:\Users\User\Documents\* /F /Q

Before performing a formatting process, ransomware collect and send all the victims information into the attacker by establish the connection with Command & control server.


 Command to delete Desktop files

Command to format local disk drive

According to Quick heal Research, Though we have seen the connectivity of the ransomware to the CnC server, we have not seen any data being backed up on the server, hence, users are advised not to pay any ransom as the malware authors will not be able to restore the data.

Once the ransomware complete its operation then finally it drops the ransomware note that contain the detailed information that says “victim’s database and files back up on their secured server. “

Warning message say that the victims need to pay the 0.1 bitcoin to the wallet that they mention in the ransomware notes and the backed up data will be return to the victim within 24 hours once the payment will be made from victims end.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates also you can take the Best Cybersecurity courses online to keep your self-updated.

Also Read:Ransomware Attack Response and Mitigation Checklist


Website

Latest articles

Octo Tempest Know for Attacking VMWare ESXi Servers Added RansomHub & Qilin to Its Arsenal

Threat actors often attack VMware ESXi servers since they accommodate many virtual machines, which...

TAG-100 Actors Using Open-Source Tools To Attack Gov & Private Orgs

Hackers exploit open-source tools to execute attacks because they are readily available, well-documented, and...

macOS Users Beware Of Weaponized Meeting App From North Korean Hackers

Meeting apps are often targeted and turned into weapons by hackers as they are...

Hackers Exploiting Legitimate RMM Tools With BugSleep Malware

Since October 2023, MuddyWater, which is an Iranian threat group linked to MOIS, has...

Cybercriminals Exploit Attack on Donald Trump for Crypto Scams

Researchers at Bitdefender Labs remain ever-vigilant, informing users about the latest scams and internet...

New TE.0 HTTP Request Smuggling Flaw Impacts Google Cloud Websites

HTTP Request Smuggling is a flaw in web security that is derived from variations...

Volcano Demon Group Attacking Organizations With LukaLocker Ransomware

The Volcano Demon group has been discovered spreading a new ransomware called LukaLocker, which...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Free Webinar

Low Rate DDoS Attack

9 of 10 sites on the AppTrana network have faced a DDoS attack in the last 30 days.
Some DDoS attacks could readily be blocked by rate-limiting, IP reputation checks and other basic mitigation methods.
More than 50% of the DDoS attacks are employing botnets to send slow DDoS attacks where millions of IPs are being employed to send one or two requests per minute..
Key takeaways include:

  • The mechanics of a low-DDoS attack
  • Fundamentals of behavioural AI and rate-limiting
  • Surgical mitigation actions to minimize false positives
  • Role of managed services in DDoS monitoring

Related Articles