General
-
Target
424c0a292d3a06d3f9a6971193e0e2aa38101bb5551429e5a40d6a9287ece4b6
-
Size
575KB
-
Sample
220316-1kkf4sghb3
-
MD5
fea353766b5dd23f832a044ceefb5420
-
SHA1
7a561c7f096aeef6eed90743213d7b5ef74f8b99
-
SHA256
424c0a292d3a06d3f9a6971193e0e2aa38101bb5551429e5a40d6a9287ece4b6
-
SHA512
14417f3a1abab932e5144541f42c4b276ecfa39c8231850084332848f661a4c933ab9b47d2400855816a0ef0a5d5136b3350441abeec137e746a2820f4568c6e
Behavioral task
behavioral1
Sample
424c0a292d3a06d3f9a6971193e0e2aa38101bb5551429e5a40d6a9287ece4b6.exe
Resource
win7-20220311-en
Behavioral task
behavioral2
Sample
424c0a292d3a06d3f9a6971193e0e2aa38101bb5551429e5a40d6a9287ece4b6.exe
Resource
win10v2004-en-20220113
Malware Config
Extracted
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
http://pexdatax.com/
Targets
-
-
Target
424c0a292d3a06d3f9a6971193e0e2aa38101bb5551429e5a40d6a9287ece4b6
-
Size
575KB
-
MD5
fea353766b5dd23f832a044ceefb5420
-
SHA1
7a561c7f096aeef6eed90743213d7b5ef74f8b99
-
SHA256
424c0a292d3a06d3f9a6971193e0e2aa38101bb5551429e5a40d6a9287ece4b6
-
SHA512
14417f3a1abab932e5144541f42c4b276ecfa39c8231850084332848f661a4c933ab9b47d2400855816a0ef0a5d5136b3350441abeec137e746a2820f4568c6e
Score10/10-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Drops file in System32 directory
-