dharma

Target

The-MALWARE-Repo
Size

284KB
Sample

240629-jrbzwatdqe
MD5

1c0a02c3390b9fd77746574def84b1d1
SHA1

2e62ae7936cf5b6398308f702ddbb06427091109
SHA256

29dc64e0ada4c711d0452801d3364b2f44cf4bd52337547aaa2f40744da97cd1
SHA512

4f62bc5c219a6fa412dc06653227561b10cb32d144be733e0b2e57dea24baa17683dc09b84c57237326e6909e27f42ea7e1f70032eeff455d12423364bc433a2
SSDEEP

6144:ibRoQ02n9dH5M2vkm0y3Cl3pId9Rj9vvZJT3CqbMrhryfQNRPaCieMjAkvCJv1VZ:qRoQ02n9dH5M2vkm0y3Cl3pId9Rj9vvC

Score

10^/10

Malware Config

Targets

- Target
  
  The-MALWARE-Repo
- Size
  
  284KB
- MD5
  
  1c0a02c3390b9fd77746574def84b1d1
- SHA1
  
  2e62ae7936cf5b6398308f702ddbb06427091109
- SHA256
  
  29dc64e0ada4c711d0452801d3364b2f44cf4bd52337547aaa2f40744da97cd1
- SHA512
  
  4f62bc5c219a6fa412dc06653227561b10cb32d144be733e0b2e57dea24baa17683dc09b84c57237326e6909e27f42ea7e1f70032eeff455d12423364bc433a2
- SSDEEP
  
  6144:ibRoQ02n9dH5M2vkm0y3Cl3pId9Rj9vvZJT3CqbMrhryfQNRPaCieMjAkvCJv1VZ:qRoQ02n9dH5M2vkm0y3Cl3pId9Rj9vvC
Score

10^/10

dharma defense_evasion evasion execution impact persistence privilege_escalation ransomware spyware stealer upx
- Dharma
  Dharma is a ransomware that uses security software installation to hide malicious activities.
  ransomware dharma
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Renames multiple (592) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Disables Task Manager via registry modification
  evasion
- Drops file in Drivers directory
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Deletes itself
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
behavioral1