General
-
Target
6f64d864d4cdeaa6062e44e34c0969ebdead56edb22e5a2b61c987ca3400fad4
-
Size
92KB
-
Sample
220929-hanfxabagj
-
MD5
fb0e8cdaae96f5da8f73b3e30af023fb
-
SHA1
5b0e1b47b42e6d1d068736f5106224fe2001624b
-
SHA256
6f64d864d4cdeaa6062e44e34c0969ebdead56edb22e5a2b61c987ca3400fad4
-
SHA512
33449b04cc7913b54e2e1ec2c3d1f600f0d9b9ca3abb129fd46ef391e504f6f0cd9446340311f623b748788d70e4eca71d0e80a3d2c1700642f8c959b91f3bd0
-
SSDEEP
1536:mBwl+KXpsqN5vlwWYyhY9S4Awnyn9Jv4RYIhnIJANjOX:Qw+asqN5aW/hLyyn5JA5
Static task
static1
Behavioral task
behavioral1
Sample
6f64d864d4cdeaa6062e44e34c0969ebdead56edb22e5a2b61c987ca3400fad4.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
6f64d864d4cdeaa6062e44e34c0969ebdead56edb22e5a2b61c987ca3400fad4.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
iq200@tutanota.com
iq200@msgsafe.io
Targets
-
-
Target
6f64d864d4cdeaa6062e44e34c0969ebdead56edb22e5a2b61c987ca3400fad4
-
Size
92KB
-
MD5
fb0e8cdaae96f5da8f73b3e30af023fb
-
SHA1
5b0e1b47b42e6d1d068736f5106224fe2001624b
-
SHA256
6f64d864d4cdeaa6062e44e34c0969ebdead56edb22e5a2b61c987ca3400fad4
-
SHA512
33449b04cc7913b54e2e1ec2c3d1f600f0d9b9ca3abb129fd46ef391e504f6f0cd9446340311f623b748788d70e4eca71d0e80a3d2c1700642f8c959b91f3bd0
-
SSDEEP
1536:mBwl+KXpsqN5vlwWYyhY9S4Awnyn9Jv4RYIhnIJANjOX:Qw+asqN5aW/hLyyn5JA5
Score10/10-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Drops file in System32 directory
-