dharma

Sharing

Copy URL Twitter E-mail

General

Target
samples (2) (2).zip
Size 11.5MB
Sample240101-sladjafeg6
SHA256 8ed183df76d08024f15e051f4f5711535dde6372ff4beafecfff07f82e846800
MD5 3103452bf9094d6f3ec5ddee144b821a
SHA1 1995b4171447b7e11302682b29c34bba4c5939f9
SHA512 3559e9e28f7ba881207ba01fd0c2eedf29f91d88b7c44c938fbec73e756a39ab0e072f88072bb82365e7476f6247658f8d59147e64eee6fb825003085b4edb6f
SSDEEP 196608:1g0w+y495NuivJ1dlbNm5IemCPIurAW58NFfApXHUxcSeVIDF/je3ZSEMIVab0gx:1g0w+F5NuivJFbN4mCz5Uip0OFVuepWn
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

djvu

http://zexeq.com/lancer/get.php
http://acacaca.org/test1/get.php
http://zexeq.com/test1/get.php

Attributes

extension
.qarj
offline_id
VrBq0iLIRHjQLgVRLsN1WK8yFkTCRDCCvPkwnHt1
payload_url
http://uaery.top/dl/build2.exe

http://zexeq.com/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-zUVSNg4KRZ Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0664Iopd

rsa_pubkey.plain

Extracted

Path

C:\odt\How_to_back_files.html

Ransom Note

<html> <style type="text/css"> body { background-color: #f5f5f5; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ display: block; margin: auto; } .tabs1 .head{ text-align: center; float: top; padding: 0px; text-transform: uppercase; font-weight: normal; display: block; background: #81bef7; color: #DF0101; font-size: 30px; } .tabs1 .identi { font-size: 10px; text-align: center; float: top; padding: 15px; display: block; background: #81bef7; color: #DFDFDF; word-break: break-all; } .tabs .content { background: #f5f5f5; /*text-align: center;*/ color: #000000; padding: 25px 15px; font-size: 15px; font-weight: 400; line-height: 20px; } .tabs .content a { color: #df0130; font-size: 23px; font-style: italic; text-decoration: none; line-height: 35px; } .tabs .content .text{ padding: 25px; line-height: 1.2; } </style> <body> <div class="tabs1"> <div class="head" ><b>Your personal ID:</b></div> <div class="identi"> <span style="width:1000px; color: #ffffff; font-size: 10px;">12iec8udKAwgNDlfFlYWEh+E+2+3WkGCaBQIXbI3nXeVgc79eWg5to+G1mJCEkTNKkqRiaf3PAFkZbqRtTOUyUP0mo1xO6RSmnPtCZAEMDq/ibKF6RUrvTdRbS8wNFsr33whVLvoDm7z3uol/qDkqGGNqKMsPGo4nUlBZDbWnjLLcWt5k1Fv1owvqu80+jgN2Ni+8lUU2VQs01sCFzo6uh8L2jJc7iuxEKHI6KCKNmLjAY/xB8FyH6+8XpIQVW1vXYAikbJd0rj+U/iNOl5o3w8mrKRjy4hjMCXXT92+OD1bSvAVuAunYYNS/ikCV8r/+BOV5ZeU94VCCtg/+ydlibpI0v+D6436YR8QDQ0frejJC2JkYUGaUCZGG06DFQLzfpyoXnvsqVN8IUT8aYusv91R3Eed8sjZlsF2blnjSoCc7nRHMSpBzECp4G7+9jo25YfQliv3ko7VDrnIiPQHR1iq2fPl+xG9fBPl/F2c6A6g6+6vFUguahe+dydy8pLAvR22g+HOku57wTwnuL5K7jwGoXZ0O6pQADV/XMU4tTF4yeeQapBj33Fu+ZpzE9Q6wNaWmKRQMVO6qNXS/herMQZ5wtaUDz9uNMGNJASx4nY8JfcR7JMfz+e9z/hAoLmraKJxXxfRWfcOX0mIcECmVJqLe+raa7OBrnBL2S/4SQixrzlro7gPnFsYBJVj//ieyhvlZ8JnBs9ORDMP4vCm8rrLhG0iit8PPdmOoOZXYE4+eXDSquieeI43pNIts4yMbD4O1VHwDXpbw2YjGyFiWW43mBnYJn83VKP/QHhoIh4pGtuY2D0HzLMNYxJm20yMv5goLB8Uh0GgrakNHg+oQlfvkK0U2dgZHRjZWgf9c70FYlbSRTGGaHpavdD6Irkst/yLteNPvSurd4iN7AqxEbFq6HLIe5SBAnUiys4tWkNhOXu0udo6wvqYNiF7p2EavVDAF4774178VSY+DOl26GR/O5psN6QWqKutWyY9M8rDDfW6ttu72MJ21YbWenJ8g1TfG3nWNqtwdUWi5nMgohAXeY0uwV2TMZN4FiWpT8I1MpYhseA0AnJAVRI9wfYeUDekcFP5/tr2Q46/qTOSx+4E18mD0tffuxFypLFxWpio8NT0g52Hov5/W1XVWy45Fp+Kcp9fYH9uVtRMK0mRa25pQlnfq6W+iGbJvXTvKVRv1wXqVAE3kM6q1fdWC4Sqlx82YCG44AFF1g+lJHtKHQILE2acljG4+OGm6avagqOt7g8dxw0O3+oZEP7y4zpeEJ0F+EbDNbR4ZydRDvQ0SPhZKFqu7/K/MjyxHlI6ipZyca/wVMFHskQ1nRrvdduhKm2c3RiEktbT2JLHBzt9yCO6YWzsCHIpuRCod2YKX5USEfoGx2YCcYOns+1EHXw/5wghu47/9mgQeCBBu34KTmguKmZU5FfbNaRfUZ4CzAfVdF0QZ0EzQlFLss9zXpQntlz+si8xq+dPV7liwY9HYCn7IeqYZHyy2YhlWsPNY2oV95zI+D9M3+BA7zQPoTEig0iIAlxHb3id9awclf6jxLNCZTyLMMBlgDQijeT+9eKYMVe/H0QBdBFSqmV4tpwWoqLHlZhA4ypXwLWb+30eSNVXgKqC9Fvqx7n/gXgTeucQzHkgVThgdPqPHvtN4CQuC3t8Xh9FrjYK3W/DVzKXIu3yn1V3yGOsrpVyTe57VCw=</span> <br>  </div> </div>  <div class="tabs">  <div class="tab"> <div id="tab-content1" class="content"> <div class="text">  <b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br> <b>All your important files have been encrypted!</b><br><br> <hr> Your files are safe! Only modified. (RSA+AES)<br><br> ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br> WILL PERMANENTLY CORRUPT IT.<br> DO NOT MODIFY ENCRYPTED FILES.<br> DO NOT RENAME ENCRYPTED FILES.<br><br> No software available on internet can help you. We are the only ones able to<br> solve your problem.<br><br> We gathered highly confidential/personal data. These data are currently stored on<br> a private server. This server will be immediately destroyed after your payment.<br> If you decide to not pay, we will release your data to public or re-seller.<br> So you can expect your data to be publicly available in the near future..<br><br> We only seek money and our goal is not to damage your reputation or prevent<br> your business from running.<br><br> You will can send us 2-3 non-important files and we will decrypt it for free<br> to prove we are able to give your files back.<br><br>  <hr> <b>Contact us for price and get decryption software.</b><br><br> <hr> <b>email:</b><br> <a href="[email protected] ">[email protected] </a> <br> <a href="[email protected] ">[email protected] </a> <br> <p>* To contact us, create a new free email account on the site: <a href="https://protonmail.com">protonmail.com <br> <b> IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br> </div> </div> </div>   </div> </div>  </div> </div> </body> </html>

Emails

href="[email protected]
">[email protected]

Extracted

Path

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta

Ransom Note

All your files have been encrypted! All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail [email protected] Write this ID in the title of your message F3A6D0AA In case of no answer in 24 hours write us to theese e-mails: [email protected] You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the decryption tool that will decrypt all your files. Free decryption as guarantee Before paying you can send us up to 1 file for free decryption. The total size of files must be less than 1Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) How to obtain Bitcoins The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price. https://localbitcoins.com/buy_bitcoins Also you can find other places to buy Bitcoins and beginners guide here: http://www.coindesk.com/information/how-can-i-buy-bitcoins/ Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Emails

[email protected]

Extracted

Path

C:\Read_Me!_.txt

Ransom Note

All Your Files Encrypted And Sensitive Data Downloaded (Financial Documents,Contracts,Invoices etc.. ). To Get Decryption Tools You Should Buy Our Decrption Tools And Then We Will Send You Decryption Tools And Delete Your Sensitive Data From Our Servers. If Payment Is Not Made We have to Publish Your Sensitive Data If Necessary Sell Them And Send Them To Your Competitors And After A While Our Servers Will Remove Your Decrypion Keys From Servers. Your Files Encrypted With Strongest Encryption Algorithm So Without Our Decryption Tools Nobody Can't Help You So Do Not Waste Your Time In Vain! Your ID: Ll8Oqk Email Address: [email protected] In Case Of Problem With First Email Write Us E-mail At : [email protected] Send Your ID In Email And Check Spam Folder. This Is Just Business To Get Benefits, If Do Not Contact Us After 48 Hours Decryption Price Will x2. What Guarantee Do We Give You ? You Should Send Some Encrypted Files To Us For Decryption Test. ---------------------------------------------------------------------- Attention! Do Not Edit Or Rename Encrypted Files. Do Not Try To Decrypt Files By Third-Party Or Data Recovery Softwares It May Damage Files. In Case Of Trying To Decrypt Files With Third-Party Sofwares,This May Make The Decryption Harder So Prices Will Be Rise. ---------------------------------------------------------------------- How To Buy Bitcoin : Buy Bitcoin Instructions At LocalBitcoins : https://localbitcoins.com/guides/how-to-buy-bitcoins Buy Bitcoin Instructions At Coindesk And Get More Info By Searching At Google : https://www.coindesk.com/learn/how-can-i-buy-bitcoin/

Emails

Targets

- Target
  samples (2) (2).zip
- Size 11.5MB
- SHA256 8ed183df76d08024f15e051f4f5711535dde6372ff4beafecfff07f82e846800
- MD5 3103452bf9094d6f3ec5ddee144b821a
- SHA1 1995b4171447b7e11302682b29c34bba4c5939f9
- SHA512 3559e9e28f7ba881207ba01fd0c2eedf29f91d88b7c44c938fbec73e756a39ab0e072f88072bb82365e7476f6247658f8d59147e64eee6fb825003085b4edb6f
- SSDEEP 196608:1g0w+y495NuivJ1dlbNm5IemCPIurAW58NFfApXHUxcSeVIDF/je3ZSEMIVab0gx:1g0w+F5NuivJFbN4mCz5Uip0OFVuepWn
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral1 behavioral2
- Target
  083e147374de04930caa882acaeda6df4821b75f869edb7386281f684e573c08
- Size 1.2MB
- SHA256 083e147374de04930caa882acaeda6df4821b75f869edb7386281f684e573c08
- MD5 26d35ecbbd980c6d2863a61914c4a1bb
- SHA1 ce2da4baff59602905fd75d10f3ac6ac2e235337
- SHA512 b192b0ee326dbb690c850832e76cd31257a47f819abaa0700647be022cb340297ad4a7496b352596715425a60aa60e7f001313ee08639d748c2c453ab79e8107
- SSDEEP 24576:h6FBigtov3pjeA+07ASgSl+YYxJuWMvV36/K+VLebSKLvBTyPj+dyqGgM0b1:2Bi53w3eqi+mfJujkyqGgHx
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10

evasion
- Modifies Windows Firewall
  evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral3 behavioral4
- Target
  12437a49d298941af8d087a1ff478a68ab4c312654153e17d598ff1c87be6b3d
- Size 426KB
- SHA256 12437a49d298941af8d087a1ff478a68ab4c312654153e17d598ff1c87be6b3d
- MD5 11db0fc2064d7c858067b99b413e357b
- SHA1 dbfe691315009c224e3b826dfb89ac7d910a7f08
- SHA512 120153a24b079eda7a55f97b31a7827f34ee8e6a69593180f0588ebc38efcee6c7a90131af366f9c0ce55288247bf4b6ab5fd9541ed365370f1f42c279ab93d8
- SSDEEP 12288:qntVoEco+qy0h6/id8Mq560WjLM7Ti/L6tdEyvIG9ij8e:mVdcvr0hCoV8OjvUdEyvItjd
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral5 behavioral6
- Target
  1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e
- Size 640KB
- SHA256 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e
- MD5 fb702537f0c25b34cc2b3dfb69025a85
- SHA1 eb8cae72ffd5361a977e186cb78fc64055748f00
- SHA512 94d2a4d9a5c689c13934bd9d2f236a421a63e90fcf6d3dd7362cbe7c64e1faacb68412b92ce743ee49e4e8adf4f91a495ccd8d0d3605e464bfccb26f31d1b843
- SSDEEP 12288:Z2X8+SnYa6TF42coyaLlGSDVmcUjErioq8iHiB6k:cM+SnAF4Uyycj24Hs6k
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

ransomware dharma persistence spyware stealer
- Dharma
  Dharma is a ransomware that uses security software installation to hide malicious activities.
  ransomware dharma
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Renames multiple (495) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Drops file in System32 directory
behavioral7 behavioral8
- Target
  2040fa2a3c5b16d74442d41d224a6ab16e0290a30f0535b18cb50de6a59686d4
- Size 400KB
- SHA256 2040fa2a3c5b16d74442d41d224a6ab16e0290a30f0535b18cb50de6a59686d4
- MD5 f9665d07df05a0a7c2c6f4019d1bba20
- SHA1 778f8bb7ba91ddf0ac9b12052d046d7f975e671a
- SHA512 cab4dae8b8534af781357df20e3f2d9522247d9b37c1afe72831b551cc218eb060fb1a7cceb158406d4d512879d06da5c9144a348a0bff077fe4f1ab20762cf8
- SSDEEP 6144:GCpNiYHtZHYdNsToSRBoptYASydR1wWhz:THiYwvUxRBn4dHz
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral10 behavioral9
- Target
  2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9
- Size 701KB
- SHA256 2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9
- MD5 6741d5aef031c6b1e51f386fefc1225e
- SHA1 95ea397aed18143bc18da02c21e693c44e373f90
- SHA512 90034da6a496dfcf2b7227b2aa585983cbe80f9a69586743eb219035c1bdab59eaa912139de0e576db2194383f1c70e16042736c1a593fd7e7a4ea93d515df5d
- SSDEEP 12288:ZohXTLkKkP0rRl6CRHCwWshS7JUc9ouDCwI/d9V5qyBmPjCkuYDaFB:ZYTLG2U/wWRVUYoUCwCVdmr7uma
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

djvu discovery persistence ransomware
- Detected Djvu ransomware
- Djvu Ransomware
  Ransomware which is a variant of the STOP family.
  ransomware djvu
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral11 behavioral12
- Target
  3538750cfe06d8fe364bc4f396229bfd08c9856f17477b0f8444d35a7f89775f
- Size 332KB
- SHA256 3538750cfe06d8fe364bc4f396229bfd08c9856f17477b0f8444d35a7f89775f
- MD5 7286267a7eeaf2c3122635c5edb71e84
- SHA1 d342d986442a20453d3c9a438766758301d88d4e
- SHA512 8567661bc656edbacd0ca59f1d1b38cad7c3101d8d06772ae1eba9828792327cbc6b4254e5e61d2b190f4f4350c6288ac2e5c811f7a4ed0c38bc4be8ccf636f0
- SSDEEP 6144:0LI9sGqBET+/evZ9zgDU/JSrJyhSdDXR0sVWorEriYtkD:d9JL+/eh90DU/JYUh01YtkD
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

evasion ransomware
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (4395) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Deletes System State backups
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  5d96952d473d386285f01726073d8f1ec46c983fe4c9d657babe9272330d655f
- Size 732KB
- SHA256 5d96952d473d386285f01726073d8f1ec46c983fe4c9d657babe9272330d655f
- MD5 9346199aa06d8fa74051e98b06cd3d26
- SHA1 9020c5dbcb80340517916272f2479001b2bfdff3
- SHA512 a7e4b195c6eefa011b729deb32ffe533ef61bb2126e68272cba26ec8b2fc49b3e75327abb9f916530db911a1b7854020234300a02c87c65d6cd89b661ce18f58
- SSDEEP 12288:FEIJVxZIpeKXqWdXoeSPEWOSNXCdepyeEPbObcy9BwoWNffeKuIhQ+0F:F3VxZIprXqWdXoDPEWO8XCdebcONXwoy
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

djvu discovery ransomware persistence
- Detected Djvu ransomware
- Djvu Ransomware
  Ransomware which is a variant of the STOP family.
  ransomware djvu
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral15 behavioral16
- Target
  63fb410fc5267c61c5099927af714a8f5f4ba6dcdeeb1f297b022879767c7222
- Size 924KB
- SHA256 63fb410fc5267c61c5099927af714a8f5f4ba6dcdeeb1f297b022879767c7222
- MD5 ec9c3efe831aaa203058927df7de6138
- SHA1 b77581e047551a70aaba0db7a57349136bd9e411
- SHA512 0d5aedcebaa660f345c549b9ae07b4d18fc01b563907b378c1cd905029bb0c6f6849e0f03c7c4a724c3448eb9c693138265a0b0129a298af3aada9bb0f447d6a
- SSDEEP 12288:tZqu3sRwqpxGCMF3dera2ybCPWy5SqZWj+6GJZy82VS1ToBgdoByOHGae0r2ivr:B3yEoro2PEpUA
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

persistence spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
behavioral17 behavioral18
- Target
  67beeb7a196a91ffdb77af4e53143e75a157ea6cf3432a2e14e1c55d11ef2f08
- Size 416KB
- SHA256 67beeb7a196a91ffdb77af4e53143e75a157ea6cf3432a2e14e1c55d11ef2f08
- MD5 bd4ea1c3cb843597d5b3a560f95840bb
- SHA1 f81c504435d27e6a502acee3d1834121517ea194
- SHA512 7ac8ef4f1f6f9aab30ea183e5377b6bdd617f7c18af86cdde4da8f2e8528835faf659b9fad8b8bffc22b98b4659967f013155c257feedddfaf9b332dd77c565a
- SSDEEP 3072:1VAz+HYRuV4ek4gX/am6/iQ0ET1fY/Tnib6qICONXvm0JZxkW5QGmwFp+1mSZoNJ:7c+HY0n/p0VTJq+9wm0sfi4J
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral19 behavioral20
- Target
  6e5678ebd457353b7c095af806f92b5f54341bbfa2c8d3f5ab03b84483013271
- Size 578KB
- SHA256 6e5678ebd457353b7c095af806f92b5f54341bbfa2c8d3f5ab03b84483013271
- MD5 e7818e26919dc4f84c6ac683f78eba88
- SHA1 47456d3f78c33e67b6d366bbff5c3896e5925527
- SHA512 95fff6c2e9428aa088f3c5565fbc52af14e53c2b58e402983947af0be3334618082775e78fd7901c8ec7b7556bda5bc9551a339ceaf2ecd651b160e3edc3b8f7
- SSDEEP 6144:ZVKpftK2A7ey6z20IJH4tsqtHJWj7pLoNam7nxDrMQW3dLG5wCNcKR4ce4NLfHxH:9R7eVI4tscJWC5Bq3d65wC8TO
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral21 behavioral22
- Target
  71506a3322b0e0bc6fc2c1a1f0ac844a82a8c3fbbfeb4e6452013b4ade7610fb
- Size 597KB
- SHA256 71506a3322b0e0bc6fc2c1a1f0ac844a82a8c3fbbfeb4e6452013b4ade7610fb
- MD5 ee754ea777505e2fd2870afb325f50e8
- SHA1 be8724e9bd48665ae0c6eedbaf8de23e5987dc45
- SHA512 a6b4acf8c94f1284458a950582ef18adfeac1496e26f537ea21c22f3574b3cffa48e547ea1b9804c45633e12b53c3f1ac1e2d536e150c84ddcbfc9223f525d85
- SSDEEP 12288:td5UKfiOLkxMAgyJ/4zBSqGuKCYminksnkyr2OMnVVs4OgcwdPsc:X5LAHPDuKC8n/dCD9Zsc
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

dharma zgrat persistence ransomware rat
- Detect ZGRat V2
- Dharma
  Dharma is a ransomware that uses security software installation to hide malicious activities.
  ransomware dharma
- ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Renames multiple (312) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Drops startup file
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral23 behavioral24
- Target
  734b9974ec7f673460deb7ae17af4eed0ad6fae862f0765068430050fc44d66d
- Size 804KB
- SHA256 734b9974ec7f673460deb7ae17af4eed0ad6fae862f0765068430050fc44d66d
- MD5 3bf9acee0ccca5d14b24d3d148e9e77d
- SHA1 e8f53145aad88480e9a055a4549aa5eaa631a51c
- SHA512 0a5bdab9e3c2aaf835d2263f4658a5c0e5021eed402e976d0e7e89dab41416ba3cd5767980396d769d0f6a993d5f0ff3294dcdfc7189c45480ef7a366961a63e
- SSDEEP 12288:miDzq+QQi5v6xH8HeYkqBeJEk3QgO92TWQunZxpFremjq8txlr:Hzq+Q3F6xHAJkEkAd9cuZfTO8Rr
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

djvu discovery persistence ransomware
- Detected Djvu ransomware
- Djvu Ransomware
  Ransomware which is a variant of the STOP family.
  ransomware djvu
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral25 behavioral26
- Target
  81a27b3dcfbd52ceb68043465a9aaa3ff6a2e4d04e487197bb23db5c76eec740
- Size 1.1MB
- SHA256 81a27b3dcfbd52ceb68043465a9aaa3ff6a2e4d04e487197bb23db5c76eec740
- MD5 7d1c7ce6a2f202bb5df3f45c7f62bac3
- SHA1 50a9f5b3130b14d5a18b418e9c355586eaecf4fb
- SHA512 48b20444b0d72a37ecbed0969e2a9d9be3efc51d75e1283bc755cad10068fb40055430dc1fc4b295aae3d31d71de86d84b4f1c29da8636a3ef0baf014eaf82cd
- SSDEEP 24576:RsBH9jqVwCwh/RICu4upRwIzAKXRYVN2uaj7MM1By+hm:uH9jJ9RspRwIDRiJak2By+hm
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

ransomware evasion
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies Windows Firewall
  evasion
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
behavioral27 behavioral28
- Target
  a1bd0fa8ada1da0181b8d108ca72a41795b55060613e0182f2cbbc592f857f46
- Size 740KB
- SHA256 a1bd0fa8ada1da0181b8d108ca72a41795b55060613e0182f2cbbc592f857f46
- MD5 b0475c2ee7b9c7f2ed5a8d6d8a8c4b5d
- SHA1 18845f37a2ffa83d62eed48f608019b1200f5ee2
- SHA512 6b860b7e7ed3f2e459e825df5e4c7d2e571c1b6dd922d8b57aeda1842463f66742e7365687ec45bc348efdde27441960f04e42b94e796fa80ef9383a7ad0cc47
- SSDEEP 12288:aSVJ90fbghORSIZgVf4wYDfpCwmx1jGHL+gQqGjcj366YEwrJUDHeW9:aSVGbghTVf5FXqIqGjcj36gYnW9
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

djvu discovery persistence ransomware
- Detected Djvu ransomware
- Djvu Ransomware
  Ransomware which is a variant of the STOP family.
  ransomware djvu
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral29 behavioral30
- Target
  a465bc08714bc760130a3f150a704df2f08af083b2aaf0c931e714019f3769e3
- Size 408KB
- SHA256 a465bc08714bc760130a3f150a704df2f08af083b2aaf0c931e714019f3769e3
- MD5 39b1a5e9d1c343a1a2a29247f9ec5699
- SHA1 5e6f9e075d196de2613f8023a672f1e72fce331e
- SHA512 b4611ded931f492d28d6da42062d891483656e6b5983e349e54b3dfb200f43c29bef3f5b53b13c3e18d449f1b0ab0c2859235411b9287b37439b83be2aa91688
- SSDEEP 12288:jueNLldLN97ji4pSc9B/CfvgLMfedSaPLaz7hyViDK:juqldL/3da9fqhaz74V
- MD5 SHA1 SHA512 SSDEEP
Score

6^/10

persistence
- Adds Run key to start application
  persistence
behavioral31 behavioral32