dharma

General

Target

aa44b122b3441dc53ab421247af4a06a8e19d14fd3eaab95c6cc8ea09c774acd
Size

334KB
Sample

220326-jw9rpsacd6
MD5

28f63afc9a270ba91c9833efb50f930e
SHA1

9121f360f3be4e3af117dbae99bf6bc2817a2c29
SHA256

aa44b122b3441dc53ab421247af4a06a8e19d14fd3eaab95c6cc8ea09c774acd
SHA512

4f70ed8d7f06cc48aa99162ef312bdc1569f680f490c9a7a964561ebf43c627f363842d76be95965215ef5aa9c2e9b459625c72be78dc4ee43e273db7507a9c5

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta

Ransom Note

YOUR FILES ARE ENCRYPTED Don't worry,you can return all your files! If you want to restore them, follow this link: email [email protected] YOUR ID If you have not been answered via the link within 12 hours,Tox - 1123AA3360A5AFB77D928C4CD99E9EF66EF28FCEEE1F840B93456FD9CE562B7F92204B0D8904 please download - https://tox.chat/download.html or http://pexdatax.com/ write to us by e-mail: [email protected] Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Emails

[email protected]

URLs

https://tox.chat/download.html

http://pexdatax.com/

Targets

- Target
  
  aa44b122b3441dc53ab421247af4a06a8e19d14fd3eaab95c6cc8ea09c774acd
- Size
  
  334KB
- MD5
  
  28f63afc9a270ba91c9833efb50f930e
- SHA1
  
  9121f360f3be4e3af117dbae99bf6bc2817a2c29
- SHA256
  
  aa44b122b3441dc53ab421247af4a06a8e19d14fd3eaab95c6cc8ea09c774acd
- SHA512
  
  4f70ed8d7f06cc48aa99162ef312bdc1569f680f490c9a7a964561ebf43c627f363842d76be95965215ef5aa9c2e9b459625c72be78dc4ee43e273db7507a9c5
Score

10^/10

dharma persistence ransomware spyware stealer
- Dharma
  Dharma is a ransomware that uses security software installation to hide malicious activities.
  ransomware dharma
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Drops file in System32 directory
behavioral1 behavioral2