General
-
Target
c4b9b6a2728d4022be29407e9e08c1a97eca3063e2230c3ea2846530275fb7ea
-
Size
237KB
-
Sample
221103-jf93jaffg4
-
MD5
0f3a1c793fdc76fb1d9b964f8cc46dca
-
SHA1
c41958540b9e7eea5885efe11c191f2f24602649
-
SHA256
c4b9b6a2728d4022be29407e9e08c1a97eca3063e2230c3ea2846530275fb7ea
-
SHA512
110648cf6e2c60c8520a93b6579c671ca43b29fb443fe4053dbc3a9984ae83a268c65365c0ff6dfd3d44017073d9d2471c0adf714a0cd61a041d0abe3f262a00
-
SSDEEP
6144:eHyiEhVZus8pWYooUiSfN6SvRGqUkSclGdM5GlnsPnXhJ:d4WYHnSfJv/6dGZPnXX
Static task
static1
Behavioral task
behavioral1
Sample
60c40af102c485d0464236fe672d302b.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
60c40af102c485d0464236fe672d302b.exe
Resource
win10v2004-20220901-en
Malware Config
Extracted
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
bitpandacom@qq.com
Extracted
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
bitpandacom@qq.com
Targets
-
-
Target
60c40af102c485d0464236fe672d302b.exe
-
Size
397KB
-
MD5
60c40af102c485d0464236fe672d302b
-
SHA1
d4a5a0dae3fb0274c48828e84ff8f960c7463406
-
SHA256
287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad
-
SHA512
4d22a012d1da6878e3a1f0a726a303084e1f775281f7518bf6712eb80b8fbbf5ef4c659a4be5d8e53ad9c2e0005ec8a3454491dcae4c517f4db7a81fcbad0dac
-
SSDEEP
6144:34OusAhTGvRi52AHAio3Ez2Ual3kYqUXK19KfFxmrAEkmB0aiA5:IOk8Q52qAio3ECXQfMfForBku0aiY
Score10/10-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Drops file in System32 directory
-