dharma

General

Target

test4.py
Size

6KB
Sample

240806-b23xcavgpm
MD5

dfb0e3f35735c67c64412aac829c07ca
SHA1

1b0f000739cc49a6341b3763d91b4502478d15a2
SHA256

ac47f02b46662b44d165011849885bf381b2d2525dd14f663871c87fa351fa86
SHA512

2dbeb97b28a5d2fc24d8e1663124419c8c8e0fe49039b08c5201a6d9282db7f4126bb0b5f15c2180d1290626c1dd3ddcb443c4f221254a9660894e2d0c26358d
SSDEEP

96:f7uxc/e/D/YQ0mgsYNry2eTX3EtcXt10E2nNnrL2:Si/e/D/8ZLV+X3D92nNnrL2

Score

10^/10

Malware Config

Targets

- Target
  
  test4.py
- Size
  
  6KB
- MD5
  
  dfb0e3f35735c67c64412aac829c07ca
- SHA1
  
  1b0f000739cc49a6341b3763d91b4502478d15a2
- SHA256
  
  ac47f02b46662b44d165011849885bf381b2d2525dd14f663871c87fa351fa86
- SHA512
  
  2dbeb97b28a5d2fc24d8e1663124419c8c8e0fe49039b08c5201a6d9282db7f4126bb0b5f15c2180d1290626c1dd3ddcb443c4f221254a9660894e2d0c26358d
- SSDEEP
  
  96:f7uxc/e/D/YQ0mgsYNry2eTX3EtcXt10E2nNnrL2:Si/e/D/8ZLV+X3D92nNnrL2
Score

10^/10

dharma credential_access defense_evasion discovery execution impact persistence privilege_escalation ransomware spyware stealer
- Dharma
  Dharma is a ransomware that uses security software installation to hide malicious activities.
  ransomware dharma
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Downloads MZ/PE file
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Deletes itself
- Drops startup file
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2
- Drops file in System32 directory
behavioral1