Over the past 24 hours, people unexpectedly realize they are blocked out of their device before Windows begins, after downloading and installing software that appears to be free and break pages. When locked out, the Computer will show a message claiming that they have been infected with Vitali Kremez and MalwareHunterTeam, both of which are well-known malware and security researchers. Here is the MBRLocker can be read below: Another version, which referred to as ‘SentinelOne Labs Ransomware’, is only distributed targeting Vitali Kremez. The text of this variant is: These infections is called MBRLockers because they overwrite a computer’s master boot log, preventing the operating system from running and showing a ransom note or other message. This form of infection can be used to keep people from accessing files through ransomware attacks such as Petya or as a destructive wiper. In this particular case, the name Kremez and MalwareHunterTeam is being tamed by a Malware developer or distributor and published as a harmful prank. To emphasize, this attack has nothing to do with MalwareHunterTeam and Kremez. A swarm of MBRLockers was recently produced on YouTube and Discord using a publicly accessible instrument. This method was used for the development of MBRLocker, both to Kremez and MalwareHunterTeam. BleepingComputer claims. The malware first backups up the original MBR of the device to a safe position until it is replaced while building MTRLockers using this method. If this wiper uses the same creator, the MBR can be recovered so that people can access the device. A fail-safe keyboard combination also existed on a sample to ress the CTRL+ALT+ESC keys to restore the MBR and to boot the device at the same time. We were, sadly, unable to get this malware‘s sample yet to decide whether or not the same builder works. Please give us a sample, or contact us on Twitter on the website you have downloaded the file if you are infected and know where you downloaded the file.
