General
-
Target
Mamona-fxb.zip
-
Size
97KB
-
Sample
250404-cjmyvaxzf1
-
MD5
3adc492579731c9857ff4748357a620a
-
SHA1
dccbc441a6544e6c456c3724f836daa118b7ed46
-
SHA256
5f53feb2ae27f293796a949894f2359042badf70a5f86b7f1b8f4e668cb9212a
-
SHA512
c505c0375ce4039751dbc8f7c2123328bd0401f93266143282c1994129ff67ec2617bf66a27058910840c035fd705feb9b4ca1889c45f645d9cfcf94a8e5ca59
-
SSDEEP
1536:yC7A7tFkNL3NIxPje7rmOf1Oc8fjfH7QJGQiqwudJOClElW0k20uyt7KxXgDyi1M:yCdNLUenx1LasJ3xdJOClEMXttm+L6
Static task
static1
Behavioral task
behavioral1
Sample
Mamona-fxb.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral2
Sample
Mamona-fxb.exe
Resource
win11-20250313-en
Malware Config
Extracted
C:\f9532e701a889cdd91b8\README.HAes.txt
http://owt3kwkxod2pvxlv3uljzskfhebhrhoedrh5gqrxyyd6rrco4frzj5ad.onion
http://bdhjur3agrogoxvwobbzpptkxhyewnjrhzqj4ug2dyfhf3dopyvvurid.onion/victim-chat/s630fx3eow8u
Targets
-
-
Target
Mamona-fxb.exe
-
Size
181KB
-
MD5
0f6d6ef9b82ece9dbbdc711ac00b5e6a
-
SHA1
15ca8d66aa1404edaa176ccd815c57effea7ed2f
-
SHA256
c5f49c0f566a114b529138f8bd222865c9fa9fa95f96ec1ded50700764a1d4e7
-
SHA512
f5404e742f997fc821f27f544884ce6d82ffef05defabdfdc0f265b4322f6b6e45a15389658c866e00704a20c36ba71f984f121521df81244cb04c49c80e61f1
-
SSDEEP
3072:GsrPf+odptGM3Nu6L6C4/nFBCkAhyhtsijLrlH5AeJl2a/18OS:GsrPWodR6CIikAhyDhvBSc18
Score10/10-
Renames multiple (181) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry
-