General
-
Target
1f083a0e010a9d72bf88bab332e8555f0a073453aa9ba6a4e2f6bd426d36e649
-
Size
500KB
-
Sample
220326-ahy9dadhh4
-
MD5
379977ee9d9923365ef8172491bcbe61
-
SHA1
408ca15f74b945df3bd31161c3b6a25100d9428e
-
SHA256
1f083a0e010a9d72bf88bab332e8555f0a073453aa9ba6a4e2f6bd426d36e649
-
SHA512
b6668389e4411764b19ba94bf05fc38714f18fee04704bddd80edc0765a4846b708b476042605b3271ff6ba2ed7eca5db717756e44989d1a9f6b4e823b402d22
Static task
static1
Behavioral task
behavioral1
Sample
1f083a0e010a9d72bf88bab332e8555f0a073453aa9ba6a4e2f6bd426d36e649.exe
Resource
win7-20220311-en
Behavioral task
behavioral2
Sample
1f083a0e010a9d72bf88bab332e8555f0a073453aa9ba6a4e2f6bd426d36e649.exe
Resource
win10v2004-en-20220113
Malware Config
Extracted
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
https://tox.chat/download.html
http://pexdatax.com/
Targets
-
-
Target
1f083a0e010a9d72bf88bab332e8555f0a073453aa9ba6a4e2f6bd426d36e649
-
Size
500KB
-
MD5
379977ee9d9923365ef8172491bcbe61
-
SHA1
408ca15f74b945df3bd31161c3b6a25100d9428e
-
SHA256
1f083a0e010a9d72bf88bab332e8555f0a073453aa9ba6a4e2f6bd426d36e649
-
SHA512
b6668389e4411764b19ba94bf05fc38714f18fee04704bddd80edc0765a4846b708b476042605b3271ff6ba2ed7eca5db717756e44989d1a9f6b4e823b402d22
Score10/10-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Drops file in System32 directory
-