dharma

General

Target

00fd74dd5519249df4a2ac90f8d22616d2a068c520d41ee19b53c7311ab65550
Size

431KB
Sample

220418-mama3abbdq
MD5

01908989c865949654fd19b58fc9657c
SHA1

a515287d73a6655c01accf6ca3705dd19c9b0d21
SHA256

00fd74dd5519249df4a2ac90f8d22616d2a068c520d41ee19b53c7311ab65550
SHA512

a93c0f6d739cba56a730a99600f226df68083e136d5be125c9448effd79662ea6019f9a0129b2782afc86e55c8f12bf05b4066791c30550265323cc83477b062

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta

Ransom Note

YOUR FILES ARE ENCRYPTED Don't worry,you can return all your files! If you want to restore them, follow this link: http://dj55huaqbbsnhwngb5rgeq65ns3nteyon7wlp32gkamzs3k2ogrdr5qd.onion/chat.php or Telegram telegram_@spacedatax Your ID 51EC4C3C Use Tor Browser to access this address. If you have not been answered via the link within 12 hours, write to us by e-mail: telegram_@spacedatax Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

URLs

http://dj55huaqbbsnhwngb5rgeq65ns3nteyon7wlp32gkamzs3k2ogrdr5qd.onion/chat.php

Targets

- Target
  
  00fd74dd5519249df4a2ac90f8d22616d2a068c520d41ee19b53c7311ab65550
- Size
  
  431KB
- MD5
  
  01908989c865949654fd19b58fc9657c
- SHA1
  
  a515287d73a6655c01accf6ca3705dd19c9b0d21
- SHA256
  
  00fd74dd5519249df4a2ac90f8d22616d2a068c520d41ee19b53c7311ab65550
- SHA512
  
  a93c0f6d739cba56a730a99600f226df68083e136d5be125c9448effd79662ea6019f9a0129b2782afc86e55c8f12bf05b4066791c30550265323cc83477b062
Score

10^/10

dharma persistence ransomware spyware stealer
- Dharma
  Dharma is a ransomware that uses security software installation to hide malicious activities.
  ransomware dharma
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Drops file in System32 directory
behavioral1 behavioral2