Threat Actors Allegedly Selling Monolock Ransomware on Dark Web Forums
## Cybersecurity: Monolock Ransomware Analysis
Cybersecurity: Monolock Ransomware Analysis
Monolock ransomware has been identified in underground forums, with version 1.0 being offered for sale. This includes stolen corporate credentials.
Initially detected in late September, the malware utilizes phishing emails with malicious Word documents. When opened, the embedded macro downloads the ransomware binary from a compromised server. File encryption is achieved using AES-256 for file payloads and RSA-2048 for key exchange, making data inaccessible without a private key.
Dark Web Informer analysts have observed that Monolock primarily targets small to mid-sized organizations in the healthcare and manufacturing sectors.
Operators require cryptocurrency payments, directing victims to a Tor-hosted payment portal that verifies transactions and provides the decryption key. Initial samples show a ransom note offering a 10 percent discount if payment is made within 48 hours.
In controlled settings, researchers have found that Monolock terminates processes associated with common backup and security software before initiating encryption.
Monolock ransomware has been identified in underground forums, with version 1.0 being offered for sale.
The malware scans for running services matching patterns such as "backup," "sql," and "vss," terminating them to prevent snapshot restores. Post-encryption, it appends the ".monolock" extension to filenames and leaves a ransom note named "README_RECOVER.txt" in each directory.
Monolock embeds itself into the Windows registry under the Run key, ensuring execution at startup. The malware binary appears as a legitimate DLL and injects into explorer.exe to avoid detection.
It employs API hashing to dynamically locate required Windows functions, complicating static signature detection. The API-hashing routine is as follows:
DWORD hash = 0xA1B2C3D4; for (char* p = moduleName; *p; ++p) { hash = ((hash > (32 - 7))) ^ *p; }
By using this routine, Monolock avoids importing functions by name, complicating detection by many endpoint detection tools. This highlights the necessity for behavior-based monitoring to identify such threats.
Based on reporting by Cyber Security News.