Extracted

• • Target
    084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919
  • Size 160KB
  • SHA256 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919
  • MD5 a9a6801356bda621d857929a25919e67
  • SHA1 c71c6a6dc811aab2d597a758bd09b2177f317497
  • SHA512 19540587b5c24976eec13465bb198f366379a022a1e0db5cee46da38c84de2ad0fac358a05b90bfd0772c9a648470cb7857782f59a25ba7faa39da2145c25624
  • MD5 SHA1 SHA512

  Score

  10^/10

  ransomwaredharmapersistencespyware

  • Dharma

    Dharma is a ransomware that uses security software installation to hide malicious activities.

    ransomwaredharma

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomware

  • Drops startup file

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run entry to start application

    persistence

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  • Modifies service

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2