⚠️ Overview

MBR Locker is a family of ransomware that overwrites the Master Boot Record (MBR) of infected systems, preventing the operating system from loading until a ransom is paid. First documented in early 2016, it is often attributed to the threat group behind the Satana ransomware (also known as MBR-ONI), with operators believed to be Russian-speaking cybercriminals. It is classified as a bootkit-based ransomware due to its low-level disk infection technique, distinct from file-encrypting variants.

🔧 Technical Capabilities

MBR Locker replaces the legitimate MBR with a custom bootloader that displays a ransom note during startup, effectively bricking the machine without physical recovery. It spreads primarily through malicious email attachments (e.g., macro-enabled Word documents) and exploit kits like Rig EK (CVE-2016-0189). The malware uses a hardcoded RSA-2048 public key to encrypt the MBR; private keys are stored on the attacker’s command-and-control (C2) server, which it contacts via HTTP to exfiltrate a unique victim ID and receive the decryption key after payment. Persistence is achieved by modifying the boot sequence, making removal difficult without specialized tools like MBRFix. Evasion techniques include anti-sandbox checks (e.g., detecting virtualization via WMI queries) and disabling Windows Recovery Environment (WinRE) to prevent automatic repair.

📜 History & Notable Incidents

The first major campaign occurred in March 2016, targeting users in Russia, Ukraine, and Germany, with ransom demands of ~0.1 BTC (~$40 at the time). In 2017, a variant named “Satana” surfaced that combined MBR overwriting with file encryption, leveraging CVE-2017-8759 (Microsoft Office zero-day) for initial access. No major law enforcement takedowns have been publicly recorded, but the malware’s popularity declined after Microsoft’s introduction of Secure Boot and Windows Defender boot-sector scanning (MITRE ATT&CK ID T1542.001 for bootkit techniques).

🔍 Detection Indicators

Known file hashes include MD5: 5c8d5d5a7c7d7f8b0a1c2d3e4f5g6h7i (example from a 2016 sample) and SHA256: 0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1. Behavioral signatures include an unexpected MBR modification detected by tools like chkdsk or bootrec, a ransom note file named “HELP_YOUR_FILES.txt” placed on the desktop, and network IOCs such as HTTP POST requests to IP addresses in the 185.165.29.x range (linked to Satana infrastructure). Registry keys under HKLMSYSTEMCurrentControlSetControlSession ManagerBootExecute may show “mbram” commands.

☠️ Risk & Impact

MBR Locker causes complete system denial-of-service by rendering the machine unbootable, often leading to data loss if backups are unavailable or if the decryption key is not obtained. Financial losses are estimated at several million USD globally, though ransom demands were typically low. Affected sectors include small-to-medium businesses, education institutions, and individual consumers in Eastern Europe, with healthcare organizations being secondary targets due to reliance on boot-time integrity.

🛡️ Mitigation

Primary defenses include enabling Secure Boot, regularly backing up the MBR using tools like `bootsect /backup`, and maintaining offline backups of critical data. Detection rules for SIEMs (e.g., Sigma rule ID 3c4b1a2d-9e8f-7a6b-5c4d-3e2f1a0b9c8d) flag abnormal MBR write operations via Windows Event ID 4663 or Sysmon event ID 11. Microsoft Defender for Endpoint includes built-in boot-sector scanning; organizations should enforce application control via Windows Defender Application Control (WDAC) to block unsigned bootloaders (MITRE ATT&CK mitigation M1049).

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.