General
-
Target
NA_NA_NA_786ce74458720eexeex_JC.exe
-
Size
92KB
-
Sample
230725-vzss5sed77
-
MD5
786ce74458720ec55b824586d2e5666d
-
SHA1
6f62e7fe75a0876939e0dd95d314b83e25e1e395
-
SHA256
1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3
-
SHA512
083fe6cde08dac05043ecc0fdbc8b26b0764de7f651ad19e96a937bc27de96242f1763b701b308eab7e0b9a8dd88cbc45e9c891de505b5348581acd4e1495c33
-
SSDEEP
1536:mBwl+KXpsqN5vlwWYyhY9S4A9eAzVbobr+t+NK1GcoDc50cO2tqpbe:Qw+asqN5aW/hL2UVEnHKIcAtcO2tqpb
Static task
static1
Behavioral task
behavioral1
Sample
NA_NA_NA_786ce74458720eexeex_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
NA_NA_NA_786ce74458720eexeex_JC.exe
Resource
win10v2004-20230703-en
Malware Config
Extracted
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
datacentreback@msgsafe.io
moriartydata@onionmail.org
Targets
-
-
Target
NA_NA_NA_786ce74458720eexeex_JC.exe
-
Size
92KB
-
MD5
786ce74458720ec55b824586d2e5666d
-
SHA1
6f62e7fe75a0876939e0dd95d314b83e25e1e395
-
SHA256
1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3
-
SHA512
083fe6cde08dac05043ecc0fdbc8b26b0764de7f651ad19e96a937bc27de96242f1763b701b308eab7e0b9a8dd88cbc45e9c891de505b5348581acd4e1495c33
-
SSDEEP
1536:mBwl+KXpsqN5vlwWYyhY9S4A9eAzVbobr+t+NK1GcoDc50cO2tqpbe:Qw+asqN5aW/hL2UVEnHKIcAtcO2tqpb
Score10/10-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Renames multiple (316) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Renames multiple (473) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Drops file in System32 directory
-