bazaar.abuse.ch

chuongdong.com

zawadidone.nl

github.com

recoverymanual.html

sqlagent.exe

sqlwriter.exe

ocssd.exe

synctime.exe

isqlplussvc.exe

sqlservr.exe

ocautoupds.exe

firefoxconfig.exe

mydesktopqos.exe

mysqld.exe

mysqld-opt.exe

sqbcoreservice.exe

infopath.exe

mspub.exe

outlook.exe

thebat.exe

thebat64.exe

visio.exe

wordpad.exe

qbw64.exe

wpython.exe

dumpcap.exe

procmon64.exe

procexp64.exe

cmd.exe

lets-learn-introducing-new-trickbot.html

finch4

3808f21e56dede99bc914d90aeabe47a

https://bazaar.abuse.ch/sample/4a5ac3c6f8383cc33c795804ba5f7f5553c029bbb4a6d28f1e4d8fb5107902c1

https://blogs.blackberry.com/en/2020/12/mountlocker-ransomware-as-a-service-offers-double-extortion-capabilities-to-affiliates

https://www.vkremez.com/2017/12/lets-learn-introducing-new-trickbot.html

https://github.com/dot-asm/cryptogams/blob/master/x86_64/chacha-x86_64.pl

rule MountLocker5_0 {
	meta:
		description = "YARA rule for MountLocker v5.0"
		reference = "http://chuongdong.com/reverse engineering/2021/05/23/MountLockerRansomware/"
		author = "@cPeterr"
		tlp = "white"
	strings:
		$worm_str = "========== WORM ==========" wide
		$ransom_note_str = ".ReadManual.%0.8X" wide
		$version_str = "5.0" wide
		$chacha_str = "ChaCha20 for x86_64, CRYPTOGAMS by <appro@openssl.org>"
		$chacha_const = "expand 32-byte k"
		$lock_str = "[OK] locker.file > time=%0.3f size=%0.3f KB speed=%" wide
		$bat_str = "attrib -s -r -h %1"
		$IDirectorySearch_RIID = { EC A8 9B 10 F0 92 D0 11 A7 90 00 C0 4F D8 D5 A8 }
	condition:
		uint16(0) == 0x5a4d and all of them
}