dharma

General

Target

f9731c6a91210d68432036e839574be2130022763e2406d7a548cd330672da5d
Size

1.2MB
Sample

210228-zrl112cr4s
MD5

8c58550a8e5edbfe872391c918fa6600
SHA1

d3d1707112d7dfad769df536ca6dbbb8b45363a9
SHA256

f9731c6a91210d68432036e839574be2130022763e2406d7a548cd330672da5d
SHA512

04c24055cbb513b96a6b27b8644e061c2e177e66edec29e299549a75d33ce5b98e7bce6363f9ec107f6173927989b78eb017b43d8bb6ebcc5e3389c46db903f2

Score

10^/10

Malware Config

Extracted

Path

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta

Ransom Note

YOUR FILES ARE ENCRYPTED Don't worry,you can return all your files! If you want to restore them, follow this link: email pexdatax@gmail.com YOUR ID If you have not been answered via the link within 12 hours,Tox - 1123AA3360A5AFB77D928C4CD99E9EF66EF28FCEEE1F840B93456FD9CE562B7F92204B0D8904 please download - https://tox.chat/download.html or http://pexdatax.com/ write to us by e-mail: pexdatax@gmail.com Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Emails

pexdatax@gmail.com

URLs

https://tox.chat/download.html

http://pexdatax.com/

Targets

- Target
  
  f9731c6a91210d68432036e839574be2130022763e2406d7a548cd330672da5d
- Size
  
  1.2MB
- MD5
  
  8c58550a8e5edbfe872391c918fa6600
- SHA1
  
  d3d1707112d7dfad769df536ca6dbbb8b45363a9
- SHA256
  
  f9731c6a91210d68432036e839574be2130022763e2406d7a548cd330672da5d
- SHA512
  
  04c24055cbb513b96a6b27b8644e061c2e177e66edec29e299549a75d33ce5b98e7bce6363f9ec107f6173927989b78eb017b43d8bb6ebcc5e3389c46db903f2
Score

10^/10

dharma persistence ransomware spyware
- Dharma
  Dharma is a ransomware that uses security software installation to hide malicious activities.
  ransomware dharma
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Drops file in System32 directory
behavioral1 behavioral2