General
-
Target
3e7f30a802c595379ad3158ffe4ba5bc9e4a4d304430a2d846330adee70dc9a5.bin
-
Size
92KB
-
Sample
201016-8eq5yasgse
-
MD5
a59d58c0d8e7d0baa3107eae0e1adbd7
-
SHA1
d5a8bbc952d160010f39f608f46b2e063d1c4dea
-
SHA256
3e7f30a802c595379ad3158ffe4ba5bc9e4a4d304430a2d846330adee70dc9a5
-
SHA512
4224aadf46f6cd2c2ba205ff71f36f589c15b78a48a13651e94117f54b102037d84bdce700aabad32c286a946c16fc82b53751eb4b9118380a89473f5c823d1d
Static task
static1
Behavioral task
behavioral1
Sample
3e7f30a802c595379ad3158ffe4ba5bc9e4a4d304430a2d846330adee70dc9a5.bin.exe
Resource
win7
Behavioral task
behavioral2
Sample
3e7f30a802c595379ad3158ffe4ba5bc9e4a4d304430a2d846330adee70dc9a5.bin.exe
Resource
win10
Malware Config
Extracted
C:\Users\Admin\Desktop\FILES ENCRYPTED.txt
Extracted
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
Extracted
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
Targets
-
-
Target
3e7f30a802c595379ad3158ffe4ba5bc9e4a4d304430a2d846330adee70dc9a5.bin
-
Size
92KB
-
MD5
a59d58c0d8e7d0baa3107eae0e1adbd7
-
SHA1
d5a8bbc952d160010f39f608f46b2e063d1c4dea
-
SHA256
3e7f30a802c595379ad3158ffe4ba5bc9e4a4d304430a2d846330adee70dc9a5
-
SHA512
4224aadf46f6cd2c2ba205ff71f36f589c15b78a48a13651e94117f54b102037d84bdce700aabad32c286a946c16fc82b53751eb4b9118380a89473f5c823d1d
Score10/10-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Drops file in System32 directory
-
Modifies service
-