dharma

Sharing

Copy URL

Twitter E-mail

General

Target

New Compressed (zipped) Folder.zip
Size

22B
Sample

240311-sgxy2ahh45
MD5

76cdb2bad9582d23c1f6f4d868218d6c
SHA1

b04f3ee8f5e43fa3b162981b50bb72fe1acabb33
SHA256

8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85
SHA512

5e2f959f36b66df0580a94f384c5fc1ceeec4b2a3925f062d7b68f21758b86581ac2adcfdde73a171a28496e758ef1b23ca4951c05455cdae9357cc3b5a5825f

Score

10^/10

Malware Config

Targets

- Target
  
  New Compressed (zipped) Folder.zip
- Size
  
  22B
- MD5
  
  76cdb2bad9582d23c1f6f4d868218d6c
- SHA1
  
  b04f3ee8f5e43fa3b162981b50bb72fe1acabb33
- SHA256
  
  8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85
- SHA512
  
  5e2f959f36b66df0580a94f384c5fc1ceeec4b2a3925f062d7b68f21758b86581ac2adcfdde73a171a28496e758ef1b23ca4951c05455cdae9357cc3b5a5825f
Score

10^/10

dharma persistence ransomware spyware stealer
- Dharma
  Dharma is a ransomware that uses security software installation to hide malicious activities.
  ransomware dharma
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Renames multiple (535) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Downloads MZ/PE file
- Deletes itself
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2
- Drops file in System32 directory
behavioral1 behavioral10 behavioral11 behavioral2 behavioral3 behavioral4 behavioral5 behavioral6 behavioral7 behavioral8 behavioral9