dharma

Target

steam_pfp_1.jfif
Size

5KB
Sample

240621-gt28qszbrg
MD5

db49c318451e36edef4137e52013da0b
SHA1

672212d918f7a67e9667efa50742d30f86663cf2
SHA256

dcf6bfa9392179f23ce11d1fe78325845bf0d1a921b720ef3cd7878020623e42
SHA512

5688a951972310da828bae076187e111adbd7670a8664a40ab6c26ffd4a85243a7c6a22c5482e889b8d058a0826c0654fd855035393a2ca747c4d5f2700f2e95
SSDEEP

96:VWLxsrCRz/hrzk1aCJCUvY6gkBMmkSM8AkxudbpXSG1i:ETRzJ8DJRf3RxJYxpCyi

Score

10^/10

Malware Config

Targets

- Target
  
  steam_pfp_1.jfif
- Size
  
  5KB
- MD5
  
  db49c318451e36edef4137e52013da0b
- SHA1
  
  672212d918f7a67e9667efa50742d30f86663cf2
- SHA256
  
  dcf6bfa9392179f23ce11d1fe78325845bf0d1a921b720ef3cd7878020623e42
- SHA512
  
  5688a951972310da828bae076187e111adbd7670a8664a40ab6c26ffd4a85243a7c6a22c5482e889b8d058a0826c0654fd855035393a2ca747c4d5f2700f2e95
- SSDEEP
  
  96:VWLxsrCRz/hrzk1aCJCUvY6gkBMmkSM8AkxudbpXSG1i:ETRzJ8DJRf3RxJYxpCyi
Score

10^/10

dharma defense_evasion discovery execution impact persistence ransomware spyware stealer
- Dharma
  Dharma is a ransomware that uses security software installation to hide malicious activities.
  ransomware dharma
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Renames multiple (442) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Downloads MZ/PE file
- Deletes itself
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2
- Drops file in System32 directory
behavioral1