BlackMamba Ransomware

The BlackMamba Ransomware is a file-locking Trojan without an attached family or Ransomware-as-a-Service. The BlackMamba Ransomware blocks the user's media files by encrypting them and creates pop-ups that ask for ransoms to its Bitcoin wallet for a recovery service. Users should have a backup to prevent any need of decrypting its attack for data retrieval and let high-quality security services remove the BlackMamba Ransomware as they detect it.

The Second Evolution of a Hitherto-Unseen Snake

First available in threat databases as the 2.0 build of its project, the BlackMamba Ransomware is a recently-identifiable threat similar in features to file-locker Trojans like the Scarab Ransomware. The Windows Trojan blocks files for extorting Bitcoins from victims for recovery and uses additional anti-security attacks for support. Like most file-locking Trojans, precautions against the BlackMamba Ransomware all but require having one or more backups on other devices for an inexpensive recovery of files.

The BlackMamba Ransomware is a Windows-based, .NET Framework Trojan that uses a still-unknown encryption algorithm for keeping files from opening. The Trojan targets media formats in widespread use, such as MP3s, DOCs or JPGs. Unlike similar threats, our malware analysts see nothing in its payload that implies an extension-adding feature – although such functions are usually cosmetic, in any case.

Some security analysts estimate the BlackMamba Ransomware's being a relative of the Clay Ransomware or Ahmed Minegames Ransomware – threats significant for their attacks against workers in the educational industry. However, the HTA pop-up for a ransom note uses different formatting, although the goal is the same: getting Bitcoins from victims in return for unlocking their files. The BlackMamba Ransomware's ransom also is too cheap for well-crafted, targeted attacks, at only thirty USD.

More Suspicious Behavior from a Serpent

The BlackMamba Ransomware's threat actor reuses an e-mail address that was, already, part of a Cobra Locker Ransomware (or Cobra_Locker Ransomware) variant's campaign, but a rapid turnover of file-locker Trojans is a common fact of the industry. More importantly, our malware researchers point to lesser-seen features in the BlackMamba Ransomware: Registry changes that disable the Task Manager and Registry Editor tools, and other edits to several network settings.

However, users can edit and reverse these changes or repair Windows for regaining access to such essential applications and features easily. Recovery also should include restoring files from non-encrypted, offsite backups, such as a cloud server. Doing so instead of paying the Bitcoin ransom – regardless of its cheapness – may reduce the chances of any further development for this file-locker Trojan.

With four out of seven security products detecting new samples of this Trojan, rates should improve their accuracy over time. Victims may quarantine and retain samples for submission to the appropriate specialists and, otherwise, should have automated anti-malware tools safely delete the BlackMamba Ransomware.

Even though it's on its second release, the BlackMamba Ransomware is a newfound member of the file-locker Trojan sector of the threat landscape and may have more surprises in store for the unwary. Windows users without backups are, as always, playing with fire – or, in this case, snake venom.