dharma

General

Target

3797a1dd86bf2e8879d02cfc7c9fa601.bin
Size

68KB
Sample

230223-bknfbsgb6x
MD5

4e8f90d5de37820121458477c03cc662
SHA1

b08014a3e82cc15f5dd80f2e01c2a3846df652a8
SHA256

b30b1fabcbb30b35dd554ddf50a01d6702b485f1408e4395a649dc75b59aee8a
SHA512

0df4409023ca4d68dbaefe3d431bf1695815e928a53d7d9f573022316eabd66b47b43156214e94c43632979194c79c5cc4502b7d840defdd538897d86815d91d
SSDEEP

1536:h22ZbksIJWU+tcvDpnptjnJX4PNMUBrsc2p9DAgxODQ8igS:hZdkHJitCVh4PjCc2ppAg2i7

Score

10^/10

Malware Config

Extracted

Path

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta

Ransom Note

All your files have been encrypted! Don't worry, you can return all your files! If you want to restore them, write to the mail: [email protected] ([email protected]) YOUR ID [email protected] ------------------------------------------------------------------------------------------------------- https://tox.chat/download.html Free decryption as guarantee: Before paying you can send us up to 3 files for free decryption. The total size of files must be less than 3Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) How to obtain Bitcoins: The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price. https://localbitcoins.com/buy_bitcoins Also you can find other places to buy Bitcoins and beginners guide here: http://www.coindesk.com/information/how-can-i-buy-bitcoins/ Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Emails

[email protected]

URLs

https://tox.chat/download.html

Targets

- Target
  
  bd210c5759b815a64b7166aceae471ef622bccdde3b46fc971aa78bcb73f08f1.exe
- Size
  
  92KB
- MD5
  
  3797a1dd86bf2e8879d02cfc7c9fa601
- SHA1
  
  3df9dc4e19b52e449708bcddc3939ce662b69674
- SHA256
  
  bd210c5759b815a64b7166aceae471ef622bccdde3b46fc971aa78bcb73f08f1
- SHA512
  
  2970ffaca52a5776187120edb2cb8e6556ee8e052a4efe79c2d7d91a3e83c28a892266b271bfc22c1a9ab043ea9749bf76715453bdbe14167a13d3b54a84c82b
- SSDEEP
  
  1536:mBwl+KXpsqN5vlwWYyhY9S4A6CJyQHFEH1OKZ3StXZsGXxq7y4PX:Qw+asqN5aW/hLoCJy6qV5ZigGhWP
Score

10^/10

dharma persistence ransomware spyware stealer
- Dharma
  Dharma is a ransomware that uses security software installation to hide malicious activities.
  ransomware dharma
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Drops file in System32 directory
behavioral1 behavioral2