General
-
Target
d2f4d0029325668140884fe1532170a8747ad9ecd48d87d11f0e192ae1b84ad6
-
Size
348KB
-
Sample
220305-11y97sbbak
-
MD5
a736e0aa42d924a08b51818596cdffd3
-
SHA1
d3124b364161e918e2a71241a1f4e636df5d104b
-
SHA256
d2f4d0029325668140884fe1532170a8747ad9ecd48d87d11f0e192ae1b84ad6
-
SHA512
1079e80b1104a1c76ab951e2dc2751d3bd27537afd9ccea852d8bd3b2735204ef6fe6d44079aff02d3a255c23d6fcd67123d1b01072be647a80cb0f279cb7f80
Static task
static1
Behavioral task
behavioral1
Sample
d2f4d0029325668140884fe1532170a8747ad9ecd48d87d11f0e192ae1b84ad6.exe
Resource
win7-20220223-en
Behavioral task
behavioral2
Sample
d2f4d0029325668140884fe1532170a8747ad9ecd48d87d11f0e192ae1b84ad6.exe
Resource
win10v2004-en-20220113
Malware Config
Extracted
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
Extracted
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
Targets
-
-
Target
d2f4d0029325668140884fe1532170a8747ad9ecd48d87d11f0e192ae1b84ad6
-
Size
348KB
-
MD5
a736e0aa42d924a08b51818596cdffd3
-
SHA1
d3124b364161e918e2a71241a1f4e636df5d104b
-
SHA256
d2f4d0029325668140884fe1532170a8747ad9ecd48d87d11f0e192ae1b84ad6
-
SHA512
1079e80b1104a1c76ab951e2dc2751d3bd27537afd9ccea852d8bd3b2735204ef6fe6d44079aff02d3a255c23d6fcd67123d1b01072be647a80cb0f279cb7f80
Score10/10-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Drops file in System32 directory
-