dharma

General

Target

1dll.exe
Size

92KB
Sample

230522-pkjc9sgd25
MD5

85e909a30b4ccbd76d9a1d0d689ce807
SHA1

61cdf7aed6b2e5db0e88dd1cbb155bb1093ebd3b
SHA256

f7ca01560b2b1fb8404a5cb1f6ec7251a38ca40c22fe4199bfeaaf1c25e520a1
SHA512

a04f26a80c677d439f478d30e24b544501971c80a0cdd2f023268342daf8293776846c61230a275c0f9427319d848e5387861c7b93888bc0e505e2003cf06bbd
SSDEEP

1536:mBwl+KXpsqN5vlwWYyhY9S4ACp81XCKq9e2T14VF992X4ZlFpEJ:Qw+asqN5aW/hL44A2HAIHEJ

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta

Ransom Note

All FILES ENCRYPTED "RSA1024" All YOUR FILES HAVE BEEN ENCRYPTED!!! IF YOU WANT TO RESTORE THEM, WRITE US TO THE E-MAIL lockhelp@qq.com IN THE LETTER WRITE YOUR ID, YOUR ID 3F554453 IF YOU ARE NOT ANSWERED, WRITE TO EMAIL: lockhelp@qq.com YOUR SECRET KEY WILL BE STORED ON A SERVER 7 DAYS, AFTER 7 DAYS IT MAY BE OVERWRITTEN BY OTHER KEYS, DON'T PULL TIME, WAITING YOUR EMAIL FREE DECRYPTION FOR PROOF You can send us up to 1 file for free decryption. The total size of files must be less than 1Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) DECRYPTION PROCESS: When you make sure of decryption possibility transfer the money to our bitcoin wallet. As soon as we receive the money we will send you: 1. Decryption program. 2. Detailed instruction for decryption. 3. And individual keys for decrypting your files. !WARNING! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Emails

lockhelp@qq.com

Targets

- Target
  
  1dll.exe
- Size
  
  92KB
- MD5
  
  85e909a30b4ccbd76d9a1d0d689ce807
- SHA1
  
  61cdf7aed6b2e5db0e88dd1cbb155bb1093ebd3b
- SHA256
  
  f7ca01560b2b1fb8404a5cb1f6ec7251a38ca40c22fe4199bfeaaf1c25e520a1
- SHA512
  
  a04f26a80c677d439f478d30e24b544501971c80a0cdd2f023268342daf8293776846c61230a275c0f9427319d848e5387861c7b93888bc0e505e2003cf06bbd
- SSDEEP
  
  1536:mBwl+KXpsqN5vlwWYyhY9S4ACp81XCKq9e2T14VF992X4ZlFpEJ:Qw+asqN5aW/hL44A2HAIHEJ
Score

10^/10

dharma persistence ransomware spyware stealer
- Dharma
  Dharma is a ransomware that uses security software installation to hide malicious activities.
  ransomware dharma
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Renames multiple (313) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Drops startup file
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1