New Ransomware Strain “Mamba” Capable of Full Disk Encryption

BY:

A new discovery by a Brazilian Infosec research group called Morphus Labs should (once again) make you think twice about clicking on any unsolicited links. Dubbed “Mamba,” the new ransomware strain, like the snake it was named after, strikes with a paralyzing strength, able to lock down full disks instead of just individual files. Using an open source tool called DiskCryptor, it’s able to do great damage by deeply encrypting all the data found on the target machine’s hard drive.

mamba-1

Mamba is very similar to fellow ransomware variant Petya, both of which use a disk-level encryption system, which seems to be a growing trend in the rapid spread of ransomware. “You Are Hacked,” says the message left by Mamba, along with a number victims are expected, via a unique ID, to call to find out where to pay the bitcoin worth of ransom (worth around $600) and get the private decryption key. Actually, the full message goes something like, “You are Hacked ! H.D.D Encrypted, Contact Us For Decryption Key (w889901665@yandex.com) YOURID: 123152” (as seen in the image below):

This latest ransomware strain blocks the machine’s OS from even booting up and overwrites the boot disk master boot record, or MBR replacing it with a custom MBR that displays the ransom note asking for the decryption password. As soon as the malware variant is introduced on the targeted machine, it will reboot, but before the reboot, Mamba installs itself as a fake defragmentation service via Windows, which looks like the image at left.

Renato Marinho of Morphus Labs and his team have been working around the clock to counteract the insidious lock-down proposed by Mamba. He remarks, in a post on LinkedIn Pulse: “We found Mamba last September 7, during an incident response procedure for a multinational company that had some servers compromised by this malware in Brazil, USA and India subsidiaries.”

Marinho goes on to say that the decryption password may be the same for all victims of Mamba, also known as HDDCryptor, or that it may be something related to the victim’s environment, such as a hostname, or something similar. The Morphus Labs team has not yet located the infection vector, but they are still at it. We will try to update you on Marinho’s team’s progress.

mamba-2

In the meantime, as is the case with all of our messages on ransomware, we advise never paying the ransom, but instead letting an expert in malware infection lead a step-by-step analysis and countermeasures implementation to bypass and ultimately discard the ransomware from your computer. Also, don’t click on any unsolicited links, and have only the best antivirus software running on your network and all devices.

Let the Cybersecurity Experts Handle It

If you need further advice about cybersecurity and ransomware, CloudHesive is a proven leader in providing IT consulting and cybersecurity. Contact one of our expert IT staff at (800) 860-2040 or send us an email at [email protected] today, and we can help you with all of your cyber safety, defense, and security questions or needs.

Related Blogs

  • A call center agent on the phone is in the middle of this illustration." alt="">
    Integrate ConnectPath CX with CRM to Enhance Customer Experience and Call Center Performance

    Enable both customers and agents to do more Key Takeaways: ConnectPath CX, powered by CloudHesive, offers a way to modernize your contact center with nothing to install and configure, ready in 45...

    Learn More
  • Illustration of skill training concept, man climb up ladder to fix and lubricate gear cogs on his brain head." alt="">
    Enhance Your Customer Service Skills with Amazon Connect Training

    Amazon Connect and ConnectPath CX resources help elevate productivity, efficiency, and more  Understanding the ins and outs of a complex customer service management system helps build employee...

    Learn More
  • Against a turquoise background, workers sit around a table on their computers. In the center, a cloud has arrows that show data moving both ways, with information accessible by everyone present." alt="">
    Boost Your Business Efficiency – How to Integrate Amazon Web Services with Other Tools

    Improve collaboration, communication, and get ready to grow   The speed of business today requires a cloud partner that’s reliable, easy to use, flexible, cost-effective, scalable, fast, and...

    Learn More