dharma

General

Target

Screenshot 2024-07-17 170406.png
Size

197KB
Sample

240718-qrxd5szhjq
MD5

7bfa0d3ebbb2a47e61b4d0a96f89a198
SHA1

d8eb75bb078f7868c9fd070a4f455e27f101170a
SHA256

34ff5e904a3dc6268af261b04fb43440bc329e5ecf7219eaaf59ccbd82501701
SHA512

a5d39664831b1598855bcf905d763ef73cfdeb57742d31d9fa360eae4a7e949ee69feb404725672a7d2683fbe5e1b43827fc61b88ead64590bb0dcf7bbd70ee7
SSDEEP

6144:CvxkMyQexd18lY2d70Jc8bLy7oQBH3HyqmjYVVT:UVyQezKf7qPy7f93SqmOT

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\Documents\!Please Read Me!.txt

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1 Next, please find the decrypt software on your desktop, an executable file named "!WannaDecryptor!.exe". If it does not exsit, download the software from the address below. (You may need to disable your antivirus for a while.) rar password: wcry123 Run and follow the instructions! �

Wallets

15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1

Targets

- Target
  
  Screenshot 2024-07-17 170406.png
- Size
  
  197KB
- MD5
  
  7bfa0d3ebbb2a47e61b4d0a96f89a198
- SHA1
  
  d8eb75bb078f7868c9fd070a4f455e27f101170a
- SHA256
  
  34ff5e904a3dc6268af261b04fb43440bc329e5ecf7219eaaf59ccbd82501701
- SHA512
  
  a5d39664831b1598855bcf905d763ef73cfdeb57742d31d9fa360eae4a7e949ee69feb404725672a7d2683fbe5e1b43827fc61b88ead64590bb0dcf7bbd70ee7
- SSDEEP
  
  6144:CvxkMyQexd18lY2d70Jc8bLy7oQBH3HyqmjYVVT:UVyQezKf7qPy7f93SqmOT
Score

10^/10

dharma wannacry defense_evasion execution impact persistence ransomware spyware stealer worm
- Dharma
  Dharma is a ransomware that uses security software installation to hide malicious activities.
  ransomware dharma
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Renames multiple (318) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Downloads MZ/PE file
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Legitimate hosting services abused for malware hosting/C2
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
behavioral1