dharma

General

Target

e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568
Size

266KB
Sample

220418-l8es7sbadp
MD5

2cecd79470cd71227a29740d9bada0f2
SHA1

96f6e20475d1bf4ab7668718ebfc2887a3d49d98
SHA256

e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568
SHA512

71e4d35e4d885989b46a9117955151a8d1a0736b626e593b0ab41b70b92ef8c875ba3f3b3f9a1044bb557667fbc5661a92b396dd76ab86c1f6dd01bfcadaedf2

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta

Ransom Note

YOUR FILES ARE ENCRYPTED Don't worry,you can return all your files! If you want to restore them, follow this link: http://dj55huaqbbsnhwngb5rgeq65ns3nteyon7wlp32gkamzs3k2ogrdr5qd.onion/chat.php or Telegram telegram_@spacedatax Your ID AB3D73C4 Use Tor Browser to access this address. If you have not been answered via the link within 12 hours, write to us by e-mail: telegram_@spacedatax Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

URLs

http://dj55huaqbbsnhwngb5rgeq65ns3nteyon7wlp32gkamzs3k2ogrdr5qd.onion/chat.php

Targets

- Target
  
  e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568
- Size
  
  266KB
- MD5
  
  2cecd79470cd71227a29740d9bada0f2
- SHA1
  
  96f6e20475d1bf4ab7668718ebfc2887a3d49d98
- SHA256
  
  e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568
- SHA512
  
  71e4d35e4d885989b46a9117955151a8d1a0736b626e593b0ab41b70b92ef8c875ba3f3b3f9a1044bb557667fbc5661a92b396dd76ab86c1f6dd01bfcadaedf2
Score

10^/10

dharma persistence ransomware spyware stealer
- Dharma
  Dharma is a ransomware that uses security software installation to hide malicious activities.
  ransomware dharma
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Drops file in System32 directory
behavioral1 behavioral2