General
-
Target
4acde778f89f0750a84336f8beba4a0a43617878ca921549fec71d49e79517df
-
Size
172KB
-
Sample
220502-kaaadsehc4
-
MD5
0089a73fad1b510a3905f54a958cfbca
-
SHA1
1132436583777036c34695ca8cf694eece893635
-
SHA256
4acde778f89f0750a84336f8beba4a0a43617878ca921549fec71d49e79517df
-
SHA512
acb3c00420807c6a70b610369a4e4c8da7ed0424c86d70a9f9652740441ed6000bf0a7173dd5790dacd182d2ba7e93c4dc2184aa4b81c6a15fb353d9920ab6f3
Static task
static1
Behavioral task
behavioral1
Sample
4acde778f89f0750a84336f8beba4a0a43617878ca921549fec71d49e79517df.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
4acde778f89f0750a84336f8beba4a0a43617878ca921549fec71d49e79517df.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
http://dj55huaqbbsnhwngb5rgeq65ns3nteyon7wlp32gkamzs3k2ogrdr5qd.onion/chat.php
Targets
-
-
Target
4acde778f89f0750a84336f8beba4a0a43617878ca921549fec71d49e79517df
-
Size
172KB
-
MD5
0089a73fad1b510a3905f54a958cfbca
-
SHA1
1132436583777036c34695ca8cf694eece893635
-
SHA256
4acde778f89f0750a84336f8beba4a0a43617878ca921549fec71d49e79517df
-
SHA512
acb3c00420807c6a70b610369a4e4c8da7ed0424c86d70a9f9652740441ed6000bf0a7173dd5790dacd182d2ba7e93c4dc2184aa4b81c6a15fb353d9920ab6f3
Score10/10-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Drops file in System32 directory
-