Resubmissions

20/03/2025, 03:02

250320-djgbqs1xev 10

19/03/2025, 21:44

250319-1lgfvaxr12 10

General

  • Target

    mamona_sample.exe

  • Size

    181KB

  • Sample

    250319-1lgfvaxr12

  • MD5

    0f6d6ef9b82ece9dbbdc711ac00b5e6a

  • SHA1

    15ca8d66aa1404edaa176ccd815c57effea7ed2f

  • SHA256

    c5f49c0f566a114b529138f8bd222865c9fa9fa95f96ec1ded50700764a1d4e7

  • SHA512

    f5404e742f997fc821f27f544884ce6d82ffef05defabdfdc0f265b4322f6b6e45a15389658c866e00704a20c36ba71f984f121521df81244cb04c49c80e61f1

  • SSDEEP

    3072:GsrPf+odptGM3Nu6L6C4/nFBCkAhyhtsijLrlH5AeJl2a/18OS:GsrPWodR6CIikAhyDhvBSc18

Score
10/10

Malware Config

Extracted

Path

C:\Recovery\README.HAes.txt

Ransom Note
~~Mamona, R.I.P!~~ Welcome! Visit our blog --> http://owt3kwkxod2pvxlv3uljzskfhebhrhoedrh5gqrxyyd6rrco4frzj5ad.onion Chat ---> bdhjur3agrogoxvwobbzpptkxhyewnjrhzqj4ug2dyfhf3dopyvvurid.onion/victim-chat/s630fx3eow8u Password ---> As you may have noticed by now, all of your files were encrypted & stolen. --------------------------------------------------------------------------------- [What happened?] -> We have stolen a significant amount of your important files from your network and stored them on our servers. -> Additionally, all files are encrypted, making them inaccessible without our decryption tool. [What can you do?] --> You have two options: --> 1. Pay us for the decryption tool, and: --> - You can decrypt all your files. --> - Stolen data will be deleted from our servers. --> - You will receive a report detailing how we accessed your network and security recommendations. --> - We will stop targeting your company. --> 2. Refuse to pay and: --> - Your stolen data will be published publicly. --> - Your files will remain locked. --> - Your reputation will be damaged, and you may face legal and financial consequences. --> - We may continue targeting your company. [Warnings] --> Do not alter your files in any way. If you do, the decryption tool will not work, and you will lose access permanently. --> Do not contact law enforcement. If you do, your data will be exposed immediately. --> Do not hire a recovery company. Decrypting these files without our tool is impossible. Each file is encrypted with a unique key, and you need our tool to decrypt them.
URLs

http://owt3kwkxod2pvxlv3uljzskfhebhrhoedrh5gqrxyyd6rrco4frzj5ad.onion

http://bdhjur3agrogoxvwobbzpptkxhyewnjrhzqj4ug2dyfhf3dopyvvurid.onion/victim-chat/s630fx3eow8u

Targets

    • Target

      mamona_sample.exe

    • Size

      181KB

    • MD5

      0f6d6ef9b82ece9dbbdc711ac00b5e6a

    • SHA1

      15ca8d66aa1404edaa176ccd815c57effea7ed2f

    • SHA256

      c5f49c0f566a114b529138f8bd222865c9fa9fa95f96ec1ded50700764a1d4e7

    • SHA512

      f5404e742f997fc821f27f544884ce6d82ffef05defabdfdc0f265b4322f6b6e45a15389658c866e00704a20c36ba71f984f121521df81244cb04c49c80e61f1

    • SSDEEP

      3072:GsrPf+odptGM3Nu6L6C4/nFBCkAhyhtsijLrlH5AeJl2a/18OS:GsrPWodR6CIikAhyDhvBSc18

    Score
    10/10
    • Renames multiple (192) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

    • Deletes itself

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v15

Tasks