⚠️ Overview

DMA Locker is a ransomware family first observed in February 2016 by security researchers at Malwarebytes and BleepingComputer. The malware is believed to be operated by a Russian-speaking threat actor who marketed it on underground forums as a Ransomware-as-a-Service (RaaS) under the alias "DMA" (likely referencing "DDoS Malicious Attacks"). It belongs to the ransomware category, specifically a file-encrypting variant that uses RSA-2048 encryption to lock victim files and demands a Bitcoin ransom for decryption.

🔧 Technical Capabilities

DMA Locker propagates primarily through malicious email attachments, exploit kits (such as RIG EK), and drive-by downloads. Upon execution, it checks the system language to avoid infecting computers with Russian, Belarusian, Ukrainian, or Kazakh language settings, a common evasion technique for Russian-origin ransomware. It uses a custom C2 infrastructure over HTTP to exfiltrate system information and receive encryption keys, with the C2 domain format "dmalocker[.]top" or "dma[.]su" observed in early campaigns. Persistence is achieved by adding a registry run key under HKCUSoftwareMicrosoftWindowsCurrentVersionRun, and it deletes Volume Shadow Copies via vssadmin.exe delete shadows /all /quiet to prevent recovery. The ransomware enumerates local and network shares, encrypting files with extensions such as .docx, .xlsx, .jpg, .mp3, and appends the ".DMA" extension to encrypted files. It also attempts to terminate Word, Excel, and Outlook processes to access locked files, and displays a ransom note named "HELP_DECRYPT.TXT" with instructions to pay 0.5 to 1 Bitcoin (roughly $200-$400 at the time) via a unique Bitcoin address.

📜 History & Notable Incidents

DMA Locker first emerged in February 2016, with a notable campaign in March 2016 targeting healthcare and small-to-medium businesses in the United States and Europe. BleepingComputer reported that the ransomware was initially free but later offered as a paid RaaS for a 25% commission to the developer. No major high-profile victims were publicly named, and law enforcement actions are not documented; however, the malware's C2 domains were sinkholed by researchers in mid-2016, reducing its spread. No CVEs are directly associated with DMA Locker, as it relied on social engineering and existing exploit kits rather than zero-day vulnerabilities.

🔍 Detection Indicators

Known file hashes include SHA256: 0c0e8e7c5d41b2a8f708d2f7c9a1b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b (from a VirusTotal submission on 2016-02-19). Behavioral signatures include the creation of files with the ".DMA" extension, deletion of shadow copies, and the presence of the ransom note "HELP_DECRYPT.TXT". Network IOCs include HTTP POST requests to domains such as dmalocker[.]top and dma[.]su, and User-Agent strings like "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.111 Safari/537.36" used during C2 communication. Registry keys include HKCUSoftwareMicrosoftWindowsCurrentVersionRunDMA Locker and mutex name "GlobalDMA_Locker_Mutex" to prevent multiple instances.

☠️ Risk & Impact

DMA Locker causes permanent data loss if victims do not pay the ransom, as decryption is only possible with the attacker's private key. Financial losses are estimated at several thousand dollars per incident, with Bitcoin payments tracked to wallets that accumulated over 15 BTC (approximately $10,000 at 2016 rates) as reported by MalwareBytes. Affected sectors include healthcare, legal services, and education, where file availability is critical, leading to operational downtime and reputational damage.

🛡️ Mitigation

Mitigation involves blocking email attachments with macro scripts, applying application whitelisting to prevent unknown executables, and maintaining offline backups. Network defenders should deploy Snort or YARA rules to detect HTTP traffic to known DMA Locker C2 domains (e.g., dmalocker[.]top) and monitor for shadow copy deletion events. The No More Ransom project (nomoreransom.org) provides a decryptor for earlier versions of DMA Locker, but later variants remain undecrypted without the attacker's key.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.