MountLocker Ransomware Sample Download

MountLocker ransomware encrypts company and business user data with ChaCha20 + RSA-2048. It then demands a $ 2 million ransom in BTC to get the files back.It gives the hacked company 3 days and threatens to publish the stolen data "all over the Internet" in order to increase pressure on the victim. To do this, ransomware operators start stealing data even before encrypting files.

A new version of MountLocker is released which is targeting TurboTax files. It explicitly look for files having the .tax, .tax2009, .tax2013, .tax2014 extensions.

MountLocker Ransomware Signatures

Family: Trojan:Win32/Skeeyah!MSR
MD5: 76f547c793b5478b970c64caf04d01d4
SHA256: e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037

MountLocker Ransomware Download