Skip to main content
Live Webinar with SANS (June 25)— Agentic CTI Automation for Fun & ProfitRegister Free
Mallory
MalwareRansomwareUsed by 1 actor

Mario

Mario is the encryptor component used by the RansomHouse ransomware operation, which is also tracked as Jolly Scorpius. It is used in double-extortion attacks in which data is stolen and systems are encrypted, with victims then threatened with data leakage. The malware is closely associated with attacks against VMware ESXi environments, where affiliates can encrypt many virtual machines at once, and it targets virtualization- and backup-related files including extensions such as ova, ovf, vbk, vbm, vib, vmdk, vmem, vmsd, vmsn, and vswp. After encryption, Mario appends an extension containing the string "mario" to files, including observed variants such as ".emario", and drops a ransom note named "How To Restore Your Files.txt" in affected directories.

Multiple sources in the content state that Mario is Babuk-derived and shares code and behavior with the leaked 2021 Babuk ESXi source, including a highly similar find_files_recursive function and the same default ransom note filename. SentinelLABS identified Mario as one of the ransomware families that adopted Babuk-based ESXi encryptors from H2 2022 onward. One cited Mario ESXi sample has SHA1 048b3942c715c6bff15c94cdc0bb4414dbab9e07.

Recent Mario versions are described as significantly upgraded. The newer encryptor introduces a two-stage encryption process using a 32-byte primary key and an 8-byte secondary key, replacing earlier simpler single-pass behavior. Reported enhancements include dynamic chunk processing, sparse or selective block encryption, optimized buffer management, and support for large-file handling up to an 8 GB threshold, all of which are described as complicating static analysis and decryption. Mario is deployed alongside the MrAgent management utility, which automates ransomware deployment across ESXi hosts, maintains C2 connectivity, gathers host information, can disable the ESXi firewall, and can orchestrate encryption activity.

RansomHouse activity associated with Mario has affected organizations across healthcare, finance, transportation, and government, and some reporting in the content highlights recent targeting of German organizations with VMware infrastructure, including manufacturing, aerospace, and production sectors. High-confidence indicators directly mentioned in the content include the ransom note filename "How To Restore Your Files.txt", the ".emario" extension, and the SHA1 sample 048b3942c715c6bff15c94cdc0bb4414dbab9e07.

Share:
For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details
Ransom House

Mario ransomware is operated by Ransom House, a group that emerged in 2021. The samples share a very similar find_files_recursive function, including the default ransom note filename How To Restore Your Files.txt.

via sentinelone labssentinelone.com
MITRE ATT&CK

Techniques & procedures

4 distinct techniques documented for this family, organized by ATT&CK tactic.

Stealth

1 technique
T1497.001System ChecksEvidence1

...create Linux encryptors targeting VMware ESXi servers.

Discovery

2 techniques
T1083File and Directory DiscoveryEvidence1

Play contains the same file searching functionality as Baseline Babuk; it also implements encryption using Sosemanuk.

T1497.001System ChecksEvidence1

...create Linux encryptors targeting VMware ESXi servers.

Impact

2 techniques
T1486Data Encrypted for ImpactEvidence2

These groups focus on ESXi before other Linux variants, leveraging built-in tools for the ESXi hypervisor to kill guest machines, then encrypt crucial hypervisor files.

T1529System Shutdown/RebootEvidence1

These groups focus on ESXi before other Linux variants, leveraging built-in tools for the ESXi hypervisor to kill guest machines, then encrypt crucial hypervisor files.

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app
Hashes
1 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting
hash.sha1●●●●●●●●●●●●View more in app1 year ago
What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.
IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping4

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.