Overview

overview

10

Static

static

146b9f0038...24.exe

windows7_x64

10

146b9f0038...24.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    146b9f003889857c430df1fd1f3534b8c2296af47d2218993ebd258e14cc5e24

  • Size

    316KB

  • Sample

    220427-tew5dscaf2

  • MD5

    666441414d336462e15093621a3ac40e

  • SHA1

    2b1d8e322967e82f79796a748d6398bde54c0f9c

  • SHA256

    146b9f003889857c430df1fd1f3534b8c2296af47d2218993ebd258e14cc5e24

  • SHA512

    0aa3ef5176f23bd1c730ca5aba642796879fc5f7dafa07f0cd7bdccbdc28ced5e748908c57fc79939f12ee2007122e2ecb8a9d895014f4ccb639b3b4eb5f8d07

Score
10/10
dharmapersistenceransomwarespywarestealer

Malware Config

Targets

    • Target

      146b9f003889857c430df1fd1f3534b8c2296af47d2218993ebd258e14cc5e24

    • Size

      316KB

    • MD5

      666441414d336462e15093621a3ac40e

    • SHA1

      2b1d8e322967e82f79796a748d6398bde54c0f9c

    • SHA256

      146b9f003889857c430df1fd1f3534b8c2296af47d2218993ebd258e14cc5e24

    • SHA512

      0aa3ef5176f23bd1c730ca5aba642796879fc5f7dafa07f0cd7bdccbdc28ced5e748908c57fc79939f12ee2007122e2ecb8a9d895014f4ccb639b3b4eb5f8d07

    Score
    10/10
    dharmapersistenceransomwarespywarestealer

    • Dharma

      Dharma is a ransomware that uses security software installation to hide malicious activities.

      ransomwaredharma

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks