dharma

General

Target

.
Size

147KB
Sample

240503-vjv9bsed33
MD5

834aba75ed6bf5843b755d3aa1053949
SHA1

db29ef39812d221ee4a23bbcb6f3eb72e15d1d4c
SHA256

26a441dc6354cd8ef7edfca469ee5ba526fd757b647661cc490736e66b9cf1ac
SHA512

17f992c01ac4671bfecbbee440c5e5352d8a17af31378fcebe5028ea1a82395bc7f8fe2b26b3c2d0a16d5fa3c419bb05a0c8a82f7b6fa87fd7fdbee0a6780895
SSDEEP

1536:oUkud8LonVJoqYarK4DsYNgRyypRMPuNPV5nPztP4FPfaParP8R4DJ2PWTllU0ru:fkPL6WVMllhAY9HhqiS

Score

10^/10

Malware Config

Targets

- Target
  
  .
- Size
  
  147KB
- MD5
  
  834aba75ed6bf5843b755d3aa1053949
- SHA1
  
  db29ef39812d221ee4a23bbcb6f3eb72e15d1d4c
- SHA256
  
  26a441dc6354cd8ef7edfca469ee5ba526fd757b647661cc490736e66b9cf1ac
- SHA512
  
  17f992c01ac4671bfecbbee440c5e5352d8a17af31378fcebe5028ea1a82395bc7f8fe2b26b3c2d0a16d5fa3c419bb05a0c8a82f7b6fa87fd7fdbee0a6780895
- SSDEEP
  
  1536:oUkud8LonVJoqYarK4DsYNgRyypRMPuNPV5nPztP4FPfaParP8R4DJ2PWTllU0ru:fkPL6WVMllhAY9HhqiS
Score

10^/10

dharma defense_evasion execution impact persistence pyinstaller ransomware spyware stealer upx
- Dharma
  Dharma is a ransomware that uses security software installation to hide malicious activities.
  ransomware dharma
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Renames multiple (576) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Downloads MZ/PE file
- Deletes itself
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
behavioral1