dharma

General

Target
fortnite-skin-changer-lobby
Size 10KB
Sample240924-2vmjwstbja
SHA256 d0019364aa3673c7d62a615e41f98c0585b72808fe9e32714a73b33c52b5bdb8
MD5 e0884d5afacda7ac5d4dde84e12bdc5a
SHA1 198d0bd0c6a64f6045a12dca89140cb972bebbe0
SHA512 865fb35d877f5d21b111815387f67a8e9dbd4e5423347954bae4c34422f0f6ac500480b102d2f90a37b3977689819d0f9a9947d9da912b29fae50d828930a155
SSDEEP 192:zyHGqcEY1f+qL4lyVWdhQ82h83FEL1Q1Oso9X0F6YEUB2oKS19:wRcpf+NEknQBOTdEYz
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  fortnite-skin-changer-lobby
- Size 10KB
- SHA256 d0019364aa3673c7d62a615e41f98c0585b72808fe9e32714a73b33c52b5bdb8
- MD5 e0884d5afacda7ac5d4dde84e12bdc5a
- SHA1 198d0bd0c6a64f6045a12dca89140cb972bebbe0
- SHA512 865fb35d877f5d21b111815387f67a8e9dbd4e5423347954bae4c34422f0f6ac500480b102d2f90a37b3977689819d0f9a9947d9da912b29fae50d828930a155
- SSDEEP 192:zyHGqcEY1f+qL4lyVWdhQ82h83FEL1Q1Oso9X0F6YEUB2oKS19:wRcpf+NEknQBOTdEYz
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

discovery dharma troldesh credential_access defense_evasion evasion execution impact persistence ransomware spyware stealer trojan
- Dharma
  Dharma is a ransomware that uses security software installation to hide malicious activities.
  ransomware dharma
- Troldesh, Shade, Encoder.858
  Troldesh is a ransomware spread by malspam.
  ransomware trojan troldesh
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Renames multiple (509) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Disables Task Manager via registry modification
  evasion
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Deletes itself
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2