APT / THREAT GROUP

DMALocker

aliases

Intelligence Profile

Ransomware no extension change Encrypted files have prefix: Version 1: ABCXYZ11 - Version 2: !DMALOCK - Version 3: !DMALOCK3.0 - Version 4: !DMALOCK4.0

Threat Analysis

DMALocker is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://decrypter.emsisoft.com/

→https://github.com/hasherezade/dma_unlocker

→https://drive.google.com/drive/folders/0Bzb5kQFOXkiSMm94QzdyM3hCdDg

→https://blog.malwarebytes.org/threat-analysis/2016/02/dma-locker-a-new-ransomware-but-no-reason-to-panic/

Quick Facts

TypeAPT / Threat Group

Aliases1

Also Known As

DMALocker

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search DMALocker