dharma

General

Target

7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118
Size

92KB
Sample

240731-rb33esxakj
MD5

7cb12c7eac83f0bc7f581f4b28a041c5
SHA1

b47b064e27e0654d828f9911186e62ec385114e3
SHA256

97689f3967844dd326e7a2b68e7da5b6b3967eea7748d1e3313910a16cacdf16
SHA512

eb82b4431741921acdf899e3f9bf644341ccf31def0fcdb0d849a208e4ce82047c91ec08fb65ae13137d09c12382edda7c63bae8f5e6c486a9e75d8fbd97f199
SSDEEP

1536:mBwl+KXpsqN5vlwWYyhY9S4ANWh3WB+Yjy0bPwegunu6Jnd4H94A6:Qw+asqN5aW/hLXWZWB+N0bI8Jnud4

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta

Ransom Note

YOUR FILES ARE ENCRYPTED Don't worry,you can return all your files! If you want to restore them, follow this link: email [email protected] YOUR ID If you have not been answered via the link within 12 hours, write to us by e-mail: [email protected] Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Emails

[email protected]

Targets

- Target
  
  7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118
- Size
  
  92KB
- MD5
  
  7cb12c7eac83f0bc7f581f4b28a041c5
- SHA1
  
  b47b064e27e0654d828f9911186e62ec385114e3
- SHA256
  
  97689f3967844dd326e7a2b68e7da5b6b3967eea7748d1e3313910a16cacdf16
- SHA512
  
  eb82b4431741921acdf899e3f9bf644341ccf31def0fcdb0d849a208e4ce82047c91ec08fb65ae13137d09c12382edda7c63bae8f5e6c486a9e75d8fbd97f199
- SSDEEP
  
  1536:mBwl+KXpsqN5vlwWYyhY9S4ANWh3WB+Yjy0bPwegunu6Jnd4H94A6:Qw+asqN5aW/hLXWZWB+N0bI8Jnud4
Score

10^/10

dharma credential_access defense_evasion discovery execution impact persistence ransomware spyware stealer
- Dharma
  Dharma is a ransomware that uses security software installation to hide malicious activities.
  ransomware dharma
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Renames multiple (314) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Drops file in System32 directory
behavioral1 behavioral2