dharma

General

Target

7bdd62b697e996cabb3a992be8532971_JaffaCakes118
Size

240KB
Sample

240528-f7v6xahb77
MD5

7bdd62b697e996cabb3a992be8532971
SHA1

3a9052106aa104c96ac3028faa71b09ef7ee5b69
SHA256

bf7912bd83f3a74062274ff0cedd43c64282f5afaf88e77497673433e1ca07b4
SHA512

fe5568b10cbb97e5122d43e4ad8dfeddc0c09b6c6ae44ff07366a4202fbaedc4d589b36c46419e359a29f6e32cab4849712fafcb635dfc72c82c5f0b3e939651
SSDEEP

6144:2/X2zLxNsPMsLQcveeNXJ9k9VPmoVrsUZkf4:om9NsPMsLQrGvkzOoVr5d

Score

10^/10

Malware Config

Extracted

Path

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta

Ransom Note

YOUR FILES ARE ENCRYPTED Don't worry,you can return all your files! If you want to restore them, follow this link: http://dj55huaqbbsnhwngb5rgeq65ns3nteyon7wlp32gkamzs3k2ogrdr5qd.onion/chat.php or Telegram telegram_@spacedatax Your ID 120B62D6 Use Tor Browser to access this address. If you have not been answered via the link within 12 hours, write to us by e-mail: telegram_@spacedatax Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

URLs

http://dj55huaqbbsnhwngb5rgeq65ns3nteyon7wlp32gkamzs3k2ogrdr5qd.onion/chat.php

Extracted

Path

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta

Ransom Note

YOUR FILES ARE ENCRYPTED Don't worry,you can return all your files! If you want to restore them, follow this link: http://dj55huaqbbsnhwngb5rgeq65ns3nteyon7wlp32gkamzs3k2ogrdr5qd.onion/chat.php or Telegram telegram_@spacedatax Your ID C33E993B Use Tor Browser to access this address. If you have not been answered via the link within 12 hours, write to us by e-mail: telegram_@spacedatax Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

URLs

http://dj55huaqbbsnhwngb5rgeq65ns3nteyon7wlp32gkamzs3k2ogrdr5qd.onion/chat.php

Targets

- Target
  
  7bdd62b697e996cabb3a992be8532971_JaffaCakes118
- Size
  
  240KB
- MD5
  
  7bdd62b697e996cabb3a992be8532971
- SHA1
  
  3a9052106aa104c96ac3028faa71b09ef7ee5b69
- SHA256
  
  bf7912bd83f3a74062274ff0cedd43c64282f5afaf88e77497673433e1ca07b4
- SHA512
  
  fe5568b10cbb97e5122d43e4ad8dfeddc0c09b6c6ae44ff07366a4202fbaedc4d589b36c46419e359a29f6e32cab4849712fafcb635dfc72c82c5f0b3e939651
- SSDEEP
  
  6144:2/X2zLxNsPMsLQcveeNXJ9k9VPmoVrsUZkf4:om9NsPMsLQrGvkzOoVr5d
Score

10^/10

dharma defense_evasion execution impact persistence ransomware spyware stealer
- Dharma
  Dharma is a ransomware that uses security software installation to hide malicious activities.
  ransomware dharma
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Renames multiple (310) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Drops file in System32 directory
behavioral1 behavioral2