Extracted

• • Target

    Mamba

  • Size

    144KB

  • MD5

    90a3c3b434583638dc94a1e04e2cdce0

  • SHA1

    be67c2962da1d52e438f478d12f7d742569256b7

  • SHA256

    7ae0d31368256c75321032d41332d64cd9687a51f1cee7f7985352bd00d4b932

  • SHA512

    c468ac024c6dad2c78d093ca1bc2a6e821d4d887e9a0fb1d867d9165fac6c4d32d883cddd73af0479f3ff00a6be05f76dc209fa199c351d5b0582c29bf4a81aa

  • SSDEEP

    3072:YJAoEcMBy2XzVuYkPUVMBFSKN+kEIScDQmsc8EsnpXUVwang+7kewnvxQT/jFaYz:U4Qh22n9ddKM2vkm0aWyRv3z9KvZJT33

  Score

  10^/10

  dharmawannacrydefense_evasiondiscoveryevasionexecutionimpactpersistenceransomwarespywarestealertrojanworm

  • Dharma

    Dharma is a ransomware that uses security software installation to hide malicious activities.

    ransomwaredharma

  • Modifies WinLogon for persistence

    persistence

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • UAC bypass

    evasiontrojan

  • Wannacry

    WannaCry is a ransomware cryptoworm.

    ransomwarewormwannacry

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Renames multiple (518) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Disables use of System Restore points

    evasion

  • Downloads MZ/PE file

  • Modifies Windows Firewall

    evasion

  • Sets file execution options in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2

  • Checks system information in the registry

    System information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1