Mario
Mario is the encryptor component used by the RansomHouse ransomware operation, which is also tracked as Jolly Scorpius. It is used in double-extortion attacks in which data is stolen and systems are encrypted, with victims then threatened with data leakage. The malware is closely associated with attacks against VMware ESXi environments, where affiliates can encrypt many virtual machines at once, and it targets virtualization- and backup-related files including extensions such as ova, ovf, vbk, vbm, vib, vmdk, vmem, vmsd, vmsn, and vswp. After encryption, Mario appends an extension containing the string "mario" to files, including observed variants such as ".emario", and drops a ransom note named "How To Restore Your Files.txt" in affected directories.
Multiple sources in the content state that Mario is Babuk-derived and shares code and behavior with the leaked 2021 Babuk ESXi source, including a highly similar find_files_recursive function and the same default ransom note filename. SentinelLABS identified Mario as one of the ransomware families that adopted Babuk-based ESXi encryptors from H2 2022 onward. One cited Mario ESXi sample has SHA1 048b3942c715c6bff15c94cdc0bb4414dbab9e07.
Recent Mario versions are described as significantly upgraded. The newer encryptor introduces a two-stage encryption process using a 32-byte primary key and an 8-byte secondary key, replacing earlier simpler single-pass behavior. Reported enhancements include dynamic chunk processing, sparse or selective block encryption, optimized buffer management, and support for large-file handling up to an 8 GB threshold, all of which are described as complicating static analysis and decryption. Mario is deployed alongside the MrAgent management utility, which automates ransomware deployment across ESXi hosts, maintains C2 connectivity, gathers host information, can disable the ESXi firewall, and can orchestrate encryption activity.
RansomHouse activity associated with Mario has affected organizations across healthcare, finance, transportation, and government, and some reporting in the content highlights recent targeting of German organizations with VMware infrastructure, including manufacturing, aerospace, and production sectors. High-confidence indicators directly mentioned in the content include the ransom note filename "How To Restore Your Files.txt", the ".emario" extension, and the SHA1 sample 048b3942c715c6bff15c94cdc0bb4414dbab9e07.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Mario ransomware is operated by Ransom House, a group that emerged in 2021. The samples share a very similar find_files_recursive function, including the default ransom note filename How To Restore Your Files.txt.
Techniques & procedures
4 distinct techniques documented for this family, organized by ATT&CK tactic.
IOCs tracked for this family
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mario is the codename for the updated ransomware payload used by Ransomhouse, featuring dual-key encryption to make data recovery nearly impossible.
Mario is the primary encryptor component used in RansomHouse attacks, targeting virtualization-related files on ESXi hosts. It employs advanced, multi-stage encryption routines to hinder decryption and recovery, and is deployed via MrAgent.
Mario is the updated encryptor binary used by RansomHouse, implementing a multi-stage, dual-key encryption process that increases the complexity of decryption and recovery for victims.
Ransomware payload used by RansomHouse to encrypt ESXi virtual machine files.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.