Overview

overview

10

Static

static

ea0b83c961...72.exe

windows7_x64

10

ea0b83c961...72.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ea0b83c9616db34698c08fa0a58adf67f18f0c9d7d7f153dbc9c50e5b7683a72

  • Size

    267KB

  • Sample

    220418-l8cc3sbadm

  • MD5

    e738a4ceec768287bb4fd511d5716347

  • SHA1

    40be6837dbb3d2b3a03c0899777bf737a5349206

  • SHA256

    ea0b83c9616db34698c08fa0a58adf67f18f0c9d7d7f153dbc9c50e5b7683a72

  • SHA512

    f07bd25fb220f45b6f488caeb235f482d6c0abcca7036e85614244dc56e7fa566e17e89fab354281caa7bacf21e251e3d3d80cfa59bc1fcbf31c8887826e39a5

Score
10/10
dharmapersistenceransomwarespywarestealer

Malware Config

Targets

    • Target

      ea0b83c9616db34698c08fa0a58adf67f18f0c9d7d7f153dbc9c50e5b7683a72

    • Size

      267KB

    • MD5

      e738a4ceec768287bb4fd511d5716347

    • SHA1

      40be6837dbb3d2b3a03c0899777bf737a5349206

    • SHA256

      ea0b83c9616db34698c08fa0a58adf67f18f0c9d7d7f153dbc9c50e5b7683a72

    • SHA512

      f07bd25fb220f45b6f488caeb235f482d6c0abcca7036e85614244dc56e7fa566e17e89fab354281caa7bacf21e251e3d3d80cfa59bc1fcbf31c8887826e39a5

    Score
    10/10
    dharmapersistenceransomwarespywarestealer

    • Dharma

      Dharma is a ransomware that uses security software installation to hide malicious activities.

      ransomwaredharma

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks