MountLocker ransomware recently received an update that halved its size, but it retains a vulnerability that could potentially allow learning the random key used to encrypt files.
This ransomware began circulating in July 2020 and targets corporate networks. Its operators steal data before encrypting it and threaten victims with leaking their files unless their ransom demands, which are usually in the millions of dollars, are met.
In the second half of November, malware researchers saw the second version of MountLocker on the market with indications that operators are preparing for the new tax season.
Research by Vitali Kremez, CEO of Advanced Intelligence (AdvIntel), shows that the ransomware developers added some file extensions (.tax, .tax2009, .tax2013, .tax2014) that are related to TurboTax software for preparing tax return documents.
In a technical analysis published today, BlackBerry's Research and Intelligence Team notes that the new MountLocker variant comes with a collection of timestamps from November 6th.
The malware developers reduced the size of the 64-bit variant of the malware to 46 KB, which is about 50% smaller than the previous version. To achieve this, they removed the list of file extensions with more than 2,600 entries targeted for encryption.
It now targets a much smaller list that excludes easily replaceable file types: .EXE, .DLL, .SYS, .MSI, .MUI, .INF, .CAT, .BAT, .CMD, .PS1, .VBS, .TTF, .FON, .LNK.
The new code is very similar to the old one, the biggest change is the process of deleting shadow copies and terminating processes, which is now done with the PowerShell script before encrypting the files.
In fact, BlackBerry says that 70% of the code in the new MountLocker is the same as the previous version.
Source: bleepingcomputer.com
