dharma

General

Target

35ae37f5076806ff8d6d462477f011b1d373e2274fa92b2d3a46461332194835
Size

849KB
Sample

220626-3ebccseehk
MD5

426e633db8d0f30d23bf17d65e64e818
SHA1

89dd9b1d28ab419ac5af7997dbd2fe8e0f682de4
SHA256

35ae37f5076806ff8d6d462477f011b1d373e2274fa92b2d3a46461332194835
SHA512

f563a79607d17b28d9086d9f151006194b02f50ea65e157e907335f35609801366a43dfafcaa435d884406d5ea11f6bc56c37989ea48f53e7d73d2f7a9d424e6

Score

10^/10

Malware Config

Extracted

Path

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta

Ransom Note

YOUR FILES ARE ENCRYPTED Don't worry,you can return all your files! If you want to restore them, follow this link: zombietry4o3nzeh.onion/?ticket=6aWH6i3Gxp3cXPpqzl_A26A9EAF Use Tor Browser to access this address. If you have not been answered via the link within 12 hours, write to us by e-mail: admin@spacedatas.com Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Emails

admin@spacedatas.com

URLs

http://zombietry4o3nzeh.onion/?ticket=6aWH6i3Gxp3cXPpqzl_A26A9EAF

Extracted

Path

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta

Ransom Note

YOUR FILES ARE ENCRYPTED Don't worry,you can return all your files! If you want to restore them, follow this link: zombietry4o3nzeh.onion/?ticket=6aWH6i3Gxp3cXPpqzl_A0FC36B5 Use Tor Browser to access this address. If you have not been answered via the link within 12 hours, write to us by e-mail: admin@spacedatas.com Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Emails

admin@spacedatas.com

URLs

http://zombietry4o3nzeh.onion/?ticket=6aWH6i3Gxp3cXPpqzl_A0FC36B5

Targets

- Target
  
  35ae37f5076806ff8d6d462477f011b1d373e2274fa92b2d3a46461332194835
- Size
  
  849KB
- MD5
  
  426e633db8d0f30d23bf17d65e64e818
- SHA1
  
  89dd9b1d28ab419ac5af7997dbd2fe8e0f682de4
- SHA256
  
  35ae37f5076806ff8d6d462477f011b1d373e2274fa92b2d3a46461332194835
- SHA512
  
  f563a79607d17b28d9086d9f151006194b02f50ea65e157e907335f35609801366a43dfafcaa435d884406d5ea11f6bc56c37989ea48f53e7d73d2f7a9d424e6
Score

10^/10

dharma persistence ransomware spyware stealer upx
- Dharma
  Dharma is a ransomware that uses security software installation to hide malicious activities.
  ransomware dharma
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Drops file in System32 directory
behavioral1 behavioral2