dmalocker | 58e5387a57aa7a6feeeee884d9e908c73de48412b0036f1f4ea1b9570ce69c2a

General

Target

58e5387a57aa7a6feeeee884d9e908c73de48412b0036f1f4ea1b9570ce69c2a.sample
Size

216KB
Sample

210726-zpmsadhjh2
MD5

1dfc1cf679e362a6ba6d0f3f7a92ba7e
SHA1

2af4065eba0bd676c101e6d0ef2271e2a6865a68
SHA256

58e5387a57aa7a6feeeee884d9e908c73de48412b0036f1f4ea1b9570ce69c2a
SHA512

8786dd703b31ed761a2ba0431fb7a42f81c762ebe58918050c73596d3715f1c72d4cc6700edee8406bd1ba563a8c67eb5a1d1d50f8d1f2045a37a2ff62aff605

Score

10^/10

Malware Config

Extracted

Path

C:\ProgramData\cryptinfo.txt

Ransom Note

Attention! ! ! All of your copies of your system have been permanently deleted and the data on all partitions and workstations have been encrypted! Stay calm. You can recover all your data by making a payment of 30 BTC (24900 GBP) in Bitcoin currency in order to receive a decryption key. In order to purchase Bitcions you can use https://coincafe.com/signup.php After buying BTC send the equivalent of 30 BTC (24900 GBP) to our BTC adress: 1HN1r24sZ79yTS6pAczzyCssCtL8UsaqL6 After payment contact us to receive your decryption key. In mail title write your unique ID: DMALOCK 16:12:73:16:82:70:50:31 Our e-mail: week4004@fastmail.com ATTENTION! To ensure you that you can recover your data we are able to decrypt two files of your choice that are not larger than 1MB! ATTENTION! Even if your antivirus has removed our program, your data may be still recovered!

Emails

week4004@fastmail.com

Wallets

1HN1r24sZ79yTS6pAczzyCssCtL8UsaqL6

Targets

- Target
  
  58e5387a57aa7a6feeeee884d9e908c73de48412b0036f1f4ea1b9570ce69c2a.sample
- Size
  
  216KB
- MD5
  
  1dfc1cf679e362a6ba6d0f3f7a92ba7e
- SHA1
  
  2af4065eba0bd676c101e6d0ef2271e2a6865a68
- SHA256
  
  58e5387a57aa7a6feeeee884d9e908c73de48412b0036f1f4ea1b9570ce69c2a
- SHA512
  
  8786dd703b31ed761a2ba0431fb7a42f81c762ebe58918050c73596d3715f1c72d4cc6700edee8406bd1ba563a8c67eb5a1d1d50f8d1f2045a37a2ff62aff605
Score

10^/10

dmalocker persistence ransomware
- DMA Locker
  Ransomware family with some advanced features, like encryption of unmapped network shares.
  ransomware dmalocker
- Adds Run key to start application
  persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

DMA Locker

Adds Run key to start application

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2