dharma

General

Target

software.exe
Size

92KB
Sample

211102-kv5xsshbck
MD5

b75251731b56827c342c99aa971ba08f
SHA1

40b1c7755c51d2a01989129e789babb2b8b63ccf
SHA256

3366e3811e6efd2237a9f829af0551e46e79001ae05192e90ccf1d6c047312c1
SHA512

ddd9af6c117665383d74a81652d6f59f4967d1ca4be0b4456bc0680675c932d9f4b3448a560f343420909eb4cba7aa4f98ed7960e52783b85b220ed2b1b4f1e8

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta

Ransom Note

YOUR FILES ARE ENCRYPTED ENCRYPTED Don't worry, you can return all your files! If you want to restore them, write to the mail: [email protected] YOUR ID [email protected] ATTENTION! We recommend you contact us directly to avoid overpaying agents Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Emails

[email protected]

Targets

- Target
  
  software.exe
- Size
  
  92KB
- MD5
  
  b75251731b56827c342c99aa971ba08f
- SHA1
  
  40b1c7755c51d2a01989129e789babb2b8b63ccf
- SHA256
  
  3366e3811e6efd2237a9f829af0551e46e79001ae05192e90ccf1d6c047312c1
- SHA512
  
  ddd9af6c117665383d74a81652d6f59f4967d1ca4be0b4456bc0680675c932d9f4b3448a560f343420909eb4cba7aa4f98ed7960e52783b85b220ed2b1b4f1e8
Score

10^/10

dharma persistence ransomware spyware stealer xmrig miner
- Dharma
  Dharma is a ransomware that uses security software installation to hide malicious activities.
  ransomware dharma
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Drops file in System32 directory
behavioral1 behavioral2