General
-
Target
mamona_sample.exe
-
Size
181KB
-
Sample
250319-1lgfvaxr12
-
MD5
0f6d6ef9b82ece9dbbdc711ac00b5e6a
-
SHA1
15ca8d66aa1404edaa176ccd815c57effea7ed2f
-
SHA256
c5f49c0f566a114b529138f8bd222865c9fa9fa95f96ec1ded50700764a1d4e7
-
SHA512
f5404e742f997fc821f27f544884ce6d82ffef05defabdfdc0f265b4322f6b6e45a15389658c866e00704a20c36ba71f984f121521df81244cb04c49c80e61f1
-
SSDEEP
3072:GsrPf+odptGM3Nu6L6C4/nFBCkAhyhtsijLrlH5AeJl2a/18OS:GsrPWodR6CIikAhyDhvBSc18
Static task
static1
Behavioral task
behavioral1
Sample
mamona_sample.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
mamona_sample.exe
Resource
win10v2004-20250314-en
Malware Config
Extracted
C:\Recovery\README.HAes.txt
http://owt3kwkxod2pvxlv3uljzskfhebhrhoedrh5gqrxyyd6rrco4frzj5ad.onion
http://bdhjur3agrogoxvwobbzpptkxhyewnjrhzqj4ug2dyfhf3dopyvvurid.onion/victim-chat/s630fx3eow8u
Targets
-
-
Target
mamona_sample.exe
-
Size
181KB
-
MD5
0f6d6ef9b82ece9dbbdc711ac00b5e6a
-
SHA1
15ca8d66aa1404edaa176ccd815c57effea7ed2f
-
SHA256
c5f49c0f566a114b529138f8bd222865c9fa9fa95f96ec1ded50700764a1d4e7
-
SHA512
f5404e742f997fc821f27f544884ce6d82ffef05defabdfdc0f265b4322f6b6e45a15389658c866e00704a20c36ba71f984f121521df81244cb04c49c80e61f1
-
SSDEEP
3072:GsrPf+odptGM3Nu6L6C4/nFBCkAhyhtsijLrlH5AeJl2a/18OS:GsrPWodR6CIikAhyDhvBSc18
Score10/10-
Renames multiple (192) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry
-