dharma

General

Target

VMS RISE UP.zip
Size

223B
Sample

240730-x359ravbjl
MD5

c89a2341032dfee7b5387dbf55889262
SHA1

fc17813d0a3493ece46de2f1b0d5a2661388290d
SHA256

ca6cfc85d1eaaba430c03dbca5135aa5775daf8faf2fc9b88f37ff2dcc68aafe
SHA512

fc6581ae2c0991bc37963670deadfee8e799a18c7ea1e64039a09a80d838f3b0aa5678500e9e20db993f27fac2f05bfed51b2ea692fd1b39aea3a4ee77726aef

Score

10^/10

Malware Config

Targets

- Target
  
  start httpswww.dailymotion.comvideo.bat
- Size
  
  47B
- MD5
  
  2a565f8142203f2f7df3ca43f8b55081
- SHA1
  
  e0dc0fc6274234e7738c246dc6dcbb4811c49417
- SHA256
  
  5c6fabb375f1b5227747c2f22868f552ab696881903591632de43a6a46c99dd5
- SHA512
  
  b0af1e521f95719718a0dd0015c47b72471d8b4bac918f527c854726994f06cf03a44e85454de56f18fecce670608ecb268b4e19cb30c90a04fcc5284baa1311
Score

10^/10

dharma credential_access defense_evasion discovery execution impact persistence ransomware spyware stealer
- Dharma
  Dharma is a ransomware that uses security software installation to hide malicious activities.
  ransomware dharma
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Renames multiple (444) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Deletes itself
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2
- Drops file in System32 directory
behavioral1 behavioral2