dharma

General

Target

8e8b6818423930eea073315743b788aef2f41198961946046b7b89042cb3f95a.exe
Size

92KB
Sample

240402-pf2ztahf2y
MD5

9d919626f55b47d0766c219ba9b57d27
SHA1

b58c2abea62887342118970ac4cb791765fd72bd
SHA256

8e8b6818423930eea073315743b788aef2f41198961946046b7b89042cb3f95a
SHA512

f901ed68683c481e09b5dbd52ed4d81cdac27711d9c104e933dfcb29a2f89a2c59e8f459fbe10df87c7d66356df2c985c727a0de5c64ca83ddf0205593046008
SSDEEP

1536:mBwl+KXpsqN5vlwWYyhY9S4Aa362F8v3Fm6b+awACy3mMP6:Qw+asqN5aW/hLA362FSSuCvF

Score

10^/10

Malware Config

Extracted

Path

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta

Ransom Note

YOUR FILES ARE ENCRYPTED Don't worry,you can return all your files! If you want to restore them, follow this link: email [email protected] YOUR ID If you have not been answered via the link within 12 hours, write to us by e-mail: [email protected] Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Emails

[email protected]

Targets

- Target
  
  8e8b6818423930eea073315743b788aef2f41198961946046b7b89042cb3f95a.exe
- Size
  
  92KB
- MD5
  
  9d919626f55b47d0766c219ba9b57d27
- SHA1
  
  b58c2abea62887342118970ac4cb791765fd72bd
- SHA256
  
  8e8b6818423930eea073315743b788aef2f41198961946046b7b89042cb3f95a
- SHA512
  
  f901ed68683c481e09b5dbd52ed4d81cdac27711d9c104e933dfcb29a2f89a2c59e8f459fbe10df87c7d66356df2c985c727a0de5c64ca83ddf0205593046008
- SSDEEP
  
  1536:mBwl+KXpsqN5vlwWYyhY9S4Aa362F8v3Fm6b+awACy3mMP6:Qw+asqN5aW/hLA362FSSuCvF
Score

10^/10

dharma persistence ransomware spyware stealer
- Dharma
  Dharma is a ransomware that uses security software installation to hide malicious activities.
  ransomware dharma
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Renames multiple (311) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2