Newly discovered a distractive Ransomware Mongolock targets the databases & deleting files along with encrypting the files in order to demand the ransom amount.
Ransomware has become one of the most dangerous cyber-attack methods because of the different techniques it uses to encrypt the files and evade the detection of security software to earn money. Also, at a time, it’s not limited to encrypting user’s files but also deletes the files and formats the local disk drives.
Unlike traditional ransomware attack, Mongolock Ransomware not only encrypts the compromised victim files but also deleting the victim’s file in local drive and back up the database to demand ransom amount.
During infection session, once the file will be executed it checks for user’s folders and specific locations such as Documents, Desktop, Recent, Favorites, Music and Video.
In this case, Mongolock Ransomware using ‘format.com’, legitimate windows command formatting the folders and drives in order to delete the compromised system files.
Mongolock Ransomware Infection & Deleting Process
Once the Mangolock ransomware successfully launched it executed various command for each folder in order to perform a format operation.
- “C:\Windows\system32\cmd.exe” /c del C:\Users\Public\Desktop\* /F /Q
- “C:\Windows\system32\cmd.exe” /c del C:\Users\User\Videos\* /F /Q
- “C:\Windows\system32\cmd.exe” /c del D:\\* /F /Q
- “C:\Windows\system32\cmd.exe” /c format D: /fs:ntfs /q /y
- “C:\Windows\system32\cmd.exe” /c del C:\Users\User\Desktop\* /F /Q
- “C:\Windows\system32\cmd.exe” /c del C:\Users\User\Music\* /F /Q
- “C:\Windows\system32\cmd.exe” /c del C:\Users\User\Favorites\* /F /Q
- “C:\Windows\system32\cmd.exe” /c del C:\Users\User\Documents\* /F /Q
Before performing a formatting process, ransomware collect and send all the victims information into the attacker by establish the connection with Command & control server.
According to Quick heal Research, Though we have seen the connectivity of the ransomware to the CnC server, we have not seen any data being backed up on the server, hence, users are advised not to pay any ransom as the malware authors will not be able to restore the data.
Once the ransomware complete its operation then finally it drops the ransomware note that contain the detailed information that says “victim’s database and files back up on their secured server. “
Warning message says that the victims need to pay the 0.1 bitcoin to the wallet that they mention in the ransomware notes and the backed up data will be a return to the victim within 24 hours once the payment will be made from victims end.
How to stay safe from ransomware attacks
- Always take a backup of your important data in external drives like HDD and pen drives. Consider using a reliable Cloud service to store the data.
- Do not install any freeware or cracked versions of any software.
- Do not open any advertisement shown on websites without knowing that they are genuine.
- Disable macros while using MS Office.
- Update your antivirus to protect your system from unknown threats.
- Do not click on links or download attachments in emails from unexpected, unknown or unwanted sources.
