dharma

General

Target

4343e104559b33e4b03d44832e1f8783_JaffaCakes118
Size

239KB
Sample

240514-12a9rsag2s
MD5

4343e104559b33e4b03d44832e1f8783
SHA1

181a776a55c24b0936e313340a453d9649af9b5a
SHA256

4df8063e3d76a96ddfcd712f6397b430a67bd04a95df2a9ad11964ef212107c5
SHA512

b951d7fd71b23852f2048bebe1c50c4e5cf2de0531357358a60c99ffa3e5e2f619bd72a40c124812a3442f56646ad0b4afbb6081fece2e2dc0d0b4b5c4f18417
SSDEEP

3072:ooNukRNvLj68vaRvDVrGjuzJ6JABACCDffpg34Jy9j4oS+94pVsPHqw:rXvLjZvKBGjuzDVoJgj4H+5fV

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta

Ransom Note

YOUR FILES ARE ENCRYPTED Don't worry,you can return all your files! If you want to restore them, follow this link: http://dj55huaqbbsnhwngb5rgeq65ns3nteyon7wlp32gkamzs3k2ogrdr5qd.onion/chat.php or Telegram telegram_@spacedatax Your ID 4CA8A74C Use Tor Browser to access this address. If you have not been answered via the link within 12 hours, write to us by e-mail: telegram_@spacedatax Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

URLs

http://dj55huaqbbsnhwngb5rgeq65ns3nteyon7wlp32gkamzs3k2ogrdr5qd.onion/chat.php

Extracted

Path

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta

Ransom Note

YOUR FILES ARE ENCRYPTED Don't worry,you can return all your files! If you want to restore them, follow this link: http://dj55huaqbbsnhwngb5rgeq65ns3nteyon7wlp32gkamzs3k2ogrdr5qd.onion/chat.php or Telegram telegram_@spacedatax Your ID 61B07F6D Use Tor Browser to access this address. If you have not been answered via the link within 12 hours, write to us by e-mail: telegram_@spacedatax Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

URLs

http://dj55huaqbbsnhwngb5rgeq65ns3nteyon7wlp32gkamzs3k2ogrdr5qd.onion/chat.php

Targets

- Target
  
  4343e104559b33e4b03d44832e1f8783_JaffaCakes118
- Size
  
  239KB
- MD5
  
  4343e104559b33e4b03d44832e1f8783
- SHA1
  
  181a776a55c24b0936e313340a453d9649af9b5a
- SHA256
  
  4df8063e3d76a96ddfcd712f6397b430a67bd04a95df2a9ad11964ef212107c5
- SHA512
  
  b951d7fd71b23852f2048bebe1c50c4e5cf2de0531357358a60c99ffa3e5e2f619bd72a40c124812a3442f56646ad0b4afbb6081fece2e2dc0d0b4b5c4f18417
- SSDEEP
  
  3072:ooNukRNvLj68vaRvDVrGjuzJ6JABACCDffpg34Jy9j4oS+94pVsPHqw:rXvLjZvKBGjuzDVoJgj4H+5fV
Score

10^/10

dharma defense_evasion execution impact persistence ransomware spyware stealer
- Dharma
  Dharma is a ransomware that uses security software installation to hide malicious activities.
  ransomware dharma
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Renames multiple (322) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Drops file in System32 directory
behavioral1 behavioral2