General
-
Target
d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb
-
Size
92KB
-
Sample
220306-ckwblshge6
-
MD5
9bd01243bd68f7a4fd38430d59aa7fdd
-
SHA1
ccb27b96fe783b9eaf66d6f359be0ccfeb33470e
-
SHA256
d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb
-
SHA512
04b6cd2e15490f743456ad643ba2a3d5ba3ce9eeee7dc0fd6ef81bdb74695798bf9a73523db192f824d1fcbc5cad105b3a00f98b1e4cab7f8113a1c34edf9e28
Static task
static1
Behavioral task
behavioral1
Sample
d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe
Resource
win10v2004-en-20220113
Malware Config
Extracted
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
Extracted
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
Targets
-
-
Target
d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb
-
Size
92KB
-
MD5
9bd01243bd68f7a4fd38430d59aa7fdd
-
SHA1
ccb27b96fe783b9eaf66d6f359be0ccfeb33470e
-
SHA256
d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb
-
SHA512
04b6cd2e15490f743456ad643ba2a3d5ba3ce9eeee7dc0fd6ef81bdb74695798bf9a73523db192f824d1fcbc5cad105b3a00f98b1e4cab7f8113a1c34edf9e28
Score10/10-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Drops file in System32 directory
-