dharma

General

Target

2024-04-22_57288b550b6e95e1dd19aa36d4033449_crysis_dharma
Size

92KB
Sample

240422-jlfqwaha63
MD5

57288b550b6e95e1dd19aa36d4033449
SHA1

0326a8483619f26a27f9edb35a0cd7adebc78333
SHA256

1597f8e59c1b1d2d4818705af04f7fa0433e16d1f43ffa9a8158b23524de3991
SHA512

fbb4a248c95cf4b719bfd46e3f816791ee051568054689777187203f82849ed546a77c7b80dcbd342749ae97bc6d54de3b893c3afafcf4cc9f4b5fd0bf8d58b6
SSDEEP

1536:mBwl+KXpsqN5vlwWYyhY9S4ASIGJ0iPsaHy86Zt62nzwpdVJ6nbQP:Qw+asqN5aW/hLoIkPGZwpdVJ0

Score

10^/10

Malware Config

Extracted

Path

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta

Ransom Note

hunt All your files have been encrypted! Don't worry, you can return all your files! If you want to restore them, write to the mail: [email protected] YOUR ID [email protected] We strongly recommend that you do not use the services of intermediaries and first check the prices and conditions directly with us. The use of intermediaries may involve risks such as: -Overcharging: Intermediaries may charge inflated prices, resulting in improper additional costs to you. -Unjustified debit: There is a risk that your money may be stolen by intermediaries for personal use and they may claim that we did it. -Rejection of the transaction and termination of communication: Intermediaries may refuse to cooperate for personal reasons, which may result in termination of communication and make it difficult to resolve issues. We understand that data loss can be a critical issue, and we are proud to provide you with encrypted data recovery services. We strive to provide you with the highest level of confidence in our abilities and offer the following guarantees: ---Recovery demo: We provide the ability to decrypt up to three files up to 5 MB in size on a demo basis. Please note that these files should not contain important and critical data. Demo recovery is intended to demonstrate our skills and capabilities. ---Guaranteed Quality: We promise that when we undertake your data recovery, we will work with the utmost professionalism and attention to detail to ensure the best possible results. We use advanced technology and techniques to maximize the likelihood of a successful recovery. ---Transparent communication: Our team is always available to answer your questions and provide you with up-to-date information about the data recovery process. We appreciate your participation and feedback. Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Emails

[email protected]

Targets

- Target
  
  2024-04-22_57288b550b6e95e1dd19aa36d4033449_crysis_dharma
- Size
  
  92KB
- MD5
  
  57288b550b6e95e1dd19aa36d4033449
- SHA1
  
  0326a8483619f26a27f9edb35a0cd7adebc78333
- SHA256
  
  1597f8e59c1b1d2d4818705af04f7fa0433e16d1f43ffa9a8158b23524de3991
- SHA512
  
  fbb4a248c95cf4b719bfd46e3f816791ee051568054689777187203f82849ed546a77c7b80dcbd342749ae97bc6d54de3b893c3afafcf4cc9f4b5fd0bf8d58b6
- SSDEEP
  
  1536:mBwl+KXpsqN5vlwWYyhY9S4ASIGJ0iPsaHy86Zt62nzwpdVJ6nbQP:Qw+asqN5aW/hLoIkPGZwpdVJ0
Score

10^/10

dharma persistence ransomware spyware stealer
- Dharma
  Dharma is a ransomware that uses security software installation to hide malicious activities.
  ransomware dharma
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Renames multiple (313) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Drops file in System32 directory
behavioral1 behavioral2