dharma

General

Target

3f083bbc36e3491c317ac43ff994a1ad75314a3c0b41ddb3b5079e18ba4110b1
Size

268KB
Sample

220418-l98snsedh8
MD5

30b33d6394125d6c20049c0857ca839d
SHA1

728104018c815058007a506dd2495a9865879ead
SHA256

3f083bbc36e3491c317ac43ff994a1ad75314a3c0b41ddb3b5079e18ba4110b1
SHA512

ed5539bcf6967c02d974744a876729900170e16db75da04140894e1da1b89e043fb75844380f904285a5d5a850859b2687b589a62f83c76a309d19c994cc24e9

Score

10^/10

Malware Config

Extracted

Path

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta

Ransom Note

YOUR FILES ARE ENCRYPTED Don't worry,you can return all your files! If you want to restore them, follow this link: http://dj55huaqbbsnhwngb5rgeq65ns3nteyon7wlp32gkamzs3k2ogrdr5qd.onion/chat.php or Telegram telegram_@spacedatax Your ID ABBB7C7A Use Tor Browser to access this address. If you have not been answered via the link within 12 hours, write to us by e-mail: telegram_@spacedatax Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

URLs

http://dj55huaqbbsnhwngb5rgeq65ns3nteyon7wlp32gkamzs3k2ogrdr5qd.onion/chat.php

Targets

- Target
  
  3f083bbc36e3491c317ac43ff994a1ad75314a3c0b41ddb3b5079e18ba4110b1
- Size
  
  268KB
- MD5
  
  30b33d6394125d6c20049c0857ca839d
- SHA1
  
  728104018c815058007a506dd2495a9865879ead
- SHA256
  
  3f083bbc36e3491c317ac43ff994a1ad75314a3c0b41ddb3b5079e18ba4110b1
- SHA512
  
  ed5539bcf6967c02d974744a876729900170e16db75da04140894e1da1b89e043fb75844380f904285a5d5a850859b2687b589a62f83c76a309d19c994cc24e9
Score

10^/10

dharma persistence ransomware spyware stealer
- Dharma
  Dharma is a ransomware that uses security software installation to hide malicious activities.
  ransomware dharma
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Drops file in System32 directory
behavioral1 behavioral2