dharma

General

Target

620fb72aa352c93407afeea6f5f86e40b786c5b810782ebf244162c72becba47
Size

92KB
Sample

220305-xhn5qsafcp
MD5

d4f167bf8e83fc39e1df1fe35984f31a
SHA1

c897c7067cf1c4e66f224123a57bef7fc552deab
SHA256

620fb72aa352c93407afeea6f5f86e40b786c5b810782ebf244162c72becba47
SHA512

5cb51bbd976dd21605a744a2a677f36401af930878545913dc11af30b22205201b3f4c4686e2f5fa3789f3bf5d29bebb90b9c9ab200017441599922031146202

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta

Ransom Note

YOUR FILES ARE ENCRYPTED Don't worry,you can return all your files! If you want to restore them, follow this link: email [email protected] YOUR ID If you have not been answered via the link within 12 hours, write to us by e-mail: [email protected] Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Emails

[email protected]

Targets

- Target
  
  620fb72aa352c93407afeea6f5f86e40b786c5b810782ebf244162c72becba47
- Size
  
  92KB
- MD5
  
  d4f167bf8e83fc39e1df1fe35984f31a
- SHA1
  
  c897c7067cf1c4e66f224123a57bef7fc552deab
- SHA256
  
  620fb72aa352c93407afeea6f5f86e40b786c5b810782ebf244162c72becba47
- SHA512
  
  5cb51bbd976dd21605a744a2a677f36401af930878545913dc11af30b22205201b3f4c4686e2f5fa3789f3bf5d29bebb90b9c9ab200017441599922031146202
Score

10^/10

dharma persistence ransomware spyware stealer
- Dharma
  Dharma is a ransomware that uses security software installation to hide malicious activities.
  ransomware dharma
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Drops file in System32 directory
behavioral1 behavioral2