General
-
Target
085105e613ad37808a8db9a3c2ba5561d5d38d5c5c43b469c93d15f0d64af0c1
-
Size
92KB
-
Sample
200911-r9zcgmtzbs
-
MD5
95f91f236cf95d698d9195690133265b
-
SHA1
29f3c5cc44709847c416bc35b3043d3da1392a8c
-
SHA256
085105e613ad37808a8db9a3c2ba5561d5d38d5c5c43b469c93d15f0d64af0c1
-
SHA512
4b457010d1c02369ad8ffed852071207b3ea2b1fe55599636990977d939affc3fbd349348ddd3b63ab6e4a0835dabdb6cac66c679be20dd52e6492ec26609339
Static task
static1
Behavioral task
behavioral1
Sample
085105e613ad37808a8db9a3c2ba5561d5d38d5c5c43b469c93d15f0d64af0c1.exe
Resource
win7v200722
Behavioral task
behavioral2
Sample
085105e613ad37808a8db9a3c2ba5561d5d38d5c5c43b469c93d15f0d64af0c1.exe
Resource
win10
Malware Config
Extracted
C:\Users\Admin\Desktop\FILES ENCRYPTED.txt
zphc@cock.li
adresspower@tutanota.com
Extracted
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
zphc@cock.li
adresspower@tutanota.com
Targets
-
-
Target
085105e613ad37808a8db9a3c2ba5561d5d38d5c5c43b469c93d15f0d64af0c1
-
Size
92KB
-
MD5
95f91f236cf95d698d9195690133265b
-
SHA1
29f3c5cc44709847c416bc35b3043d3da1392a8c
-
SHA256
085105e613ad37808a8db9a3c2ba5561d5d38d5c5c43b469c93d15f0d64af0c1
-
SHA512
4b457010d1c02369ad8ffed852071207b3ea2b1fe55599636990977d939affc3fbd349348ddd3b63ab6e4a0835dabdb6cac66c679be20dd52e6492ec26609339
Score10/10-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Drops file in System32 directory
-
Modifies service
-