General

  • Target

    Mamona-fxb.zip

  • Size

    97KB

  • Sample

    250404-a7c3fazkv8

  • MD5

    3adc492579731c9857ff4748357a620a

  • SHA1

    dccbc441a6544e6c456c3724f836daa118b7ed46

  • SHA256

    5f53feb2ae27f293796a949894f2359042badf70a5f86b7f1b8f4e668cb9212a

  • SHA512

    c505c0375ce4039751dbc8f7c2123328bd0401f93266143282c1994129ff67ec2617bf66a27058910840c035fd705feb9b4ca1889c45f645d9cfcf94a8e5ca59

  • SSDEEP

    1536:yC7A7tFkNL3NIxPje7rmOf1Oc8fjfH7QJGQiqwudJOClElW0k20uyt7KxXgDyi1M:yCdNLUenx1LasJ3xdJOClEMXttm+L6

Score
10/10

Malware Config

Extracted

Path

C:\PerfLogs\README.HAes.txt

Ransom Note
~~Mamona, R.I.P!~~ Welcome! Visit our blog --> http://owt3kwkxod2pvxlv3uljzskfhebhrhoedrh5gqrxyyd6rrco4frzj5ad.onion Chat ---> bdhjur3agrogoxvwobbzpptkxhyewnjrhzqj4ug2dyfhf3dopyvvurid.onion/victim-chat/s630fx3eow8u Password ---> As you may have noticed by now, all of your files were encrypted & stolen. --------------------------------------------------------------------------------- [What happened?] -> We have stolen a significant amount of your important files from your network and stored them on our servers. -> Additionally, all files are encrypted, making them inaccessible without our decryption tool. [What can you do?] --> You have two options: --> 1. Pay us for the decryption tool, and: --> - You can decrypt all your files. --> - Stolen data will be deleted from our servers. --> - You will receive a report detailing how we accessed your network and security recommendations. --> - We will stop targeting your company. --> 2. Refuse to pay and: --> - Your stolen data will be published publicly. --> - Your files will remain locked. --> - Your reputation will be damaged, and you may face legal and financial consequences. --> - We may continue targeting your company. [Warnings] --> Do not alter your files in any way. If you do, the decryption tool will not work, and you will lose access permanently. --> Do not contact law enforcement. If you do, your data will be exposed immediately. --> Do not hire a recovery company. Decrypting these files without our tool is impossible. Each file is encrypted with a unique key, and you need our tool to decrypt them.
URLs

http://owt3kwkxod2pvxlv3uljzskfhebhrhoedrh5gqrxyyd6rrco4frzj5ad.onion

http://bdhjur3agrogoxvwobbzpptkxhyewnjrhzqj4ug2dyfhf3dopyvvurid.onion/victim-chat/s630fx3eow8u

Targets

    • Target

      Mamona-fxb.exe

    • Size

      181KB

    • MD5

      0f6d6ef9b82ece9dbbdc711ac00b5e6a

    • SHA1

      15ca8d66aa1404edaa176ccd815c57effea7ed2f

    • SHA256

      c5f49c0f566a114b529138f8bd222865c9fa9fa95f96ec1ded50700764a1d4e7

    • SHA512

      f5404e742f997fc821f27f544884ce6d82ffef05defabdfdc0f265b4322f6b6e45a15389658c866e00704a20c36ba71f984f121521df81244cb04c49c80e61f1

    • SSDEEP

      3072:GsrPf+odptGM3Nu6L6C4/nFBCkAhyhtsijLrlH5AeJl2a/18OS:GsrPWodR6CIikAhyDhvBSc18

    Score
    10/10
    • Renames multiple (173) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v15

Tasks