General
-
Target
4bbdf86d327ac03a42048029850d82af8cd93ee3937daf44693fab983e16ea75
-
Size
68KB
-
Sample
220520-e87qnaacd7
-
MD5
baf83d8e35794be3f23c27f69933fa7e
-
SHA1
a7385e307034da29765d13901e3efe45c8b5ff08
-
SHA256
4bbdf86d327ac03a42048029850d82af8cd93ee3937daf44693fab983e16ea75
-
SHA512
67a9a6a53a6efd97e4fe923eaa2a586351f59ef2c80ee93046138d928cd689a0313b98c82770aaa96eefc463c62bac3b5c3b8eabcbc018382f946f2c54ce98c8
Static task
static1
Behavioral task
behavioral1
Sample
build.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
build.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
http://zombietry4o3nzeh.onion/?ticket=I-CFpwCHeCQ9SB7qMTf_CD86A90F
Targets
-
-
Target
build.exe
-
Size
92KB
-
MD5
411f12fb592afc7f32456cbb18ecaf71
-
SHA1
22573293e8d3a95109322beb4010446402bd783f
-
SHA256
141043cebebde233ff9e5e003079dcdd3eda14b4785b6917dffbe5966fe77a82
-
SHA512
221b1a51823c471c0ef45ad8044c6d219a15422ff17c3771ff7a77dcb9c7a36522ec1bbda5129636b3622217ea8f40b9a3d340887c047b7e9f6da1d02d2a82a0
Score10/10-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Drops file in System32 directory
-