General
-
Target
07bb57628ec61e0bddcfd621e11069974f4fc3635a3b4990c600fd7d927220e6
-
Size
179KB
-
Sample
220502-mmgakshca3
-
MD5
895c44d17b2854a19b17620b6481bb7a
-
SHA1
f6b2a812c3969004fa78a2b1f1e2b695a9564736
-
SHA256
07bb57628ec61e0bddcfd621e11069974f4fc3635a3b4990c600fd7d927220e6
-
SHA512
b70e027c07b6820d106cd17145ebf9e9909e6f359b9fac66121039be5e53dca49c15565bbd9e8e6de31eaf87491d9f216ea0dddc86ad30af4aaf96b0f281e0b4
Static task
static1
Behavioral task
behavioral1
Sample
07bb57628ec61e0bddcfd621e11069974f4fc3635a3b4990c600fd7d927220e6.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
07bb57628ec61e0bddcfd621e11069974f4fc3635a3b4990c600fd7d927220e6.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
http://dj55huaqbbsnhwngb5rgeq65ns3nteyon7wlp32gkamzs3k2ogrdr5qd.onion/chat.php
Targets
-
-
Target
07bb57628ec61e0bddcfd621e11069974f4fc3635a3b4990c600fd7d927220e6
-
Size
179KB
-
MD5
895c44d17b2854a19b17620b6481bb7a
-
SHA1
f6b2a812c3969004fa78a2b1f1e2b695a9564736
-
SHA256
07bb57628ec61e0bddcfd621e11069974f4fc3635a3b4990c600fd7d927220e6
-
SHA512
b70e027c07b6820d106cd17145ebf9e9909e6f359b9fac66121039be5e53dca49c15565bbd9e8e6de31eaf87491d9f216ea0dddc86ad30af4aaf96b0f281e0b4
Score10/10-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Drops file in System32 directory
-