Extracted

• • Target

    a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30.exe

  • Size

    92KB

  • MD5

    8ebbfe0396d3442d9a5c61c9e81e95d3

  • SHA1

    7c649065f043dd8e4cc15823f77342561da18258

  • SHA256

    a91157219713de5c5e716be9a4e8196e24a822cbb3367fb28887d9460bf90d30

  • SHA512

    bbaf715a313d72f832e4a87268306c9a42a5e82065d1bab0282d94ceee93764c9fb419bc74f335baa014591db07b708813f3b19b738137b49c6a6550d89449ce

  Score

  10^/10

  ransomwaredharmapersistencespyware

  • Dharma

    Dharma is a ransomware that uses security software installation to hide malicious activities.

    ransomwaredharma

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomware

  • Drops startup file

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run entry to start application

    persistence

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  • Modifies service

    persistence
  behavioral1behavioral2