Extracted

• • Target

    winhost.exe

  • Size

    92KB

  • MD5

    37a1431c3ed1ad5264b8964b929ee919

  • SHA1

    fa26065771340320edea37b00c9453c51f66c6b3

  • SHA256

    fbbe5adbf18c37ddee49aec819a48eedd7d6c329ec0d1eab71905d5fed08ba7d

  • SHA512

    86420527eb5c8d7f53711159e426702c85fb54c5bc5d777ba3852602ee907cd7631e92d8784369011ccf956a427c43c0f2260ada6b2e82dcfe76edf2a2a374bc

  Score

  10^/10

  ransomwaredharmapersistencespyware

  • Dharma

    Dharma is a ransomware that uses security software installation to hide malicious activities.

    ransomwaredharma

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomware

  • Drops startup file

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run entry to start application

    persistence

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  • Modifies service

    persistence
  behavioral1behavioral2