dharma

General

Target

653efc3a4dec10ffb97b2bcd0b3197731a00b9f412eb0b31506ba27d628f71d2
Size

139KB
Sample

220427-whzqssffe7
MD5

6701c127b786991e4b7da189db851667
SHA1

7db26a3dd0e2d5498f0755fd46e7f04a3f9d758c
SHA256

653efc3a4dec10ffb97b2bcd0b3197731a00b9f412eb0b31506ba27d628f71d2
SHA512

ede5c4e03833d0db7323893e18945deec1d549affc2087940abc223b297204bc5c8e26bfb3cec542836b600f024c3f7fe0898668bb60145caddf215a5ac407e5

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta

Ransom Note

YOUR FILES ARE ENCRYPTED Don't worry,you can return all your files! If you want to restore them, follow this link: email [email protected] YOUR ID If you have not been answered via the link within 12 hours, write to Telegram:@pexdata - our telegram contact or http://pexdatax.com/ or email [email protected] Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Emails

[email protected]

URLs

http://pexdatax.com/

Targets

- Target
  
  653efc3a4dec10ffb97b2bcd0b3197731a00b9f412eb0b31506ba27d628f71d2
- Size
  
  139KB
- MD5
  
  6701c127b786991e4b7da189db851667
- SHA1
  
  7db26a3dd0e2d5498f0755fd46e7f04a3f9d758c
- SHA256
  
  653efc3a4dec10ffb97b2bcd0b3197731a00b9f412eb0b31506ba27d628f71d2
- SHA512
  
  ede5c4e03833d0db7323893e18945deec1d549affc2087940abc223b297204bc5c8e26bfb3cec542836b600f024c3f7fe0898668bb60145caddf215a5ac407e5
Score

10^/10

dharma persistence ransomware spyware stealer
- Dharma
  Dharma is a ransomware that uses security software installation to hide malicious activities.
  ransomware dharma
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Drops file in System32 directory
behavioral1 behavioral2