dharma

General

Target

4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44
Size

92KB
Sample

220305-3srlhaheh6
MD5

8d238d21851718af2c0615332560422a
SHA1

dd99f210b4bf89b7a5c26e7013488b84c1e1c220
SHA256

4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44
SHA512

8446d8a1669c0ed0359effb33cfe29e59560201aed39f879f0ff70615ff6dc83232885b71a5307e63ca31245128ab41666b6fb66fedf654393efa71cdb2ff045

Score

10^/10

Malware Config

Extracted

Path

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta

Ransom Note

YOUR FILES ARE ENCRYPTED Don't worry,you can return all your files! If you want to restore them, follow this link: email [email protected] YOUR ID If you have not been answered via the link within 12 hours,Telegram.org account: @rogerbackup or write to us by e-mail: [email protected] Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Emails

[email protected]

Targets

- Target
  
  4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44
- Size
  
  92KB
- MD5
  
  8d238d21851718af2c0615332560422a
- SHA1
  
  dd99f210b4bf89b7a5c26e7013488b84c1e1c220
- SHA256
  
  4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44
- SHA512
  
  8446d8a1669c0ed0359effb33cfe29e59560201aed39f879f0ff70615ff6dc83232885b71a5307e63ca31245128ab41666b6fb66fedf654393efa71cdb2ff045
Score

10^/10

dharma persistence ransomware spyware stealer
- Dharma
  Dharma is a ransomware that uses security software installation to hide malicious activities.
  ransomware dharma
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Drops file in System32 directory
behavioral1 behavioral2