General
-
Target
0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4
-
Size
92KB
-
Sample
200911-6h2f75cfps
-
MD5
44ff6136293b783a38c252ee5025dc87
-
SHA1
1207eee8da1eadc46cbf8fd4a1ac1684989ff6d1
-
SHA256
0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4
-
SHA512
b15cca683b3a5f66a4ad1ad1af2d765e6059ff09362101a8797281f3bebc341b121bfba1cdfc79f755207b093a49e069e5726e8a70453870d418c5e09beff80b
Static task
static1
Behavioral task
behavioral1
Sample
0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe
Resource
win7
Behavioral task
behavioral2
Sample
0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4.exe
Resource
win10v200722
Malware Config
Extracted
C:\Users\Admin\Desktop\FILES ENCRYPTED.txt
tcprx@cock.li
tcprx2@protonmail.ch
Extracted
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
tcprx@cock.li
tcprx2@protonmail.ch
Targets
-
-
Target
0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4
-
Size
92KB
-
MD5
44ff6136293b783a38c252ee5025dc87
-
SHA1
1207eee8da1eadc46cbf8fd4a1ac1684989ff6d1
-
SHA256
0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4
-
SHA512
b15cca683b3a5f66a4ad1ad1af2d765e6059ff09362101a8797281f3bebc341b121bfba1cdfc79f755207b093a49e069e5726e8a70453870d418c5e09beff80b
Score10/10-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Drops file in System32 directory
-
Modifies service
-