Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    Rack/023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010

  • Size

    314KB

  • MD5

    35c571a5e2465bd7d7b8c3e3eca4eaed

  • SHA1

    0e8ebcd8d1042a5f2d59c6439051dda41675e972

  • SHA256

    023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010

  • SHA512

    7c609be2fd889297d02581a21fe2560873373feb95545d77b385317da434ee20688b8891bf3bc1394210cf75b89fd543d477b6a34a4dfa4c5ef86597c05ae69d

  • SSDEEP

    6144:6/8wNshaGQ509fgkVrcfwUWVBD1+qoXzrpc2/woiWP+7z5+dC:rwyYGY01gkxEWVyj+WPWN

  Score

  10^/10

  dharmacredential_accessdefense_evasiondiscoveryexecutionimpactpersistenceransomwarespywarestealer

  • Dharma

    Dharma is a ransomware that uses security software installation to hide malicious activities.

    ransomwaredharma

  • Dharma family

    dharma

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Renames multiple (321) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Drops startup file

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  behavioral1behavioral2

• • Target

    Rack/311d088d7c22fea0c84e1f53d3ba5dd8fb9429a2cf7476e061d061c40c20d8c2

  • Size

    764KB

  • MD5

    53b1743df6b607ba17cdad0157fc3e1a

  • SHA1

    f0205a784c6a76785b3ccc4ee71196daf5adfd54

  • SHA256

    311d088d7c22fea0c84e1f53d3ba5dd8fb9429a2cf7476e061d061c40c20d8c2

  • SHA512

    79917f11c1a5547a0ab4cbe8c48ab92b51e160b79b00e379dc06daab17ee3ff55507a4b20acc702e7bc557f76363bc3982e1bd1b464bf5cdc581db5618e5a27f

  • SSDEEP

    12288:wek+VwEZ2Lm1hSQHLDbCPA8Y9JczoB9CI:wdRESuhhwoDP

  Score

  9^/10

  collectiondefense_evasiondiscoveryevasionexecutionimpactpersistenceransomwaretrojan

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral3behavioral4

• • Target

    Rack/47f84419a3c49e289492b9e348c14c268b117cd26964746fa65318c893cbe81f

  • Size

    777KB

  • MD5

    5b712f99b32783231704adc73a251e46

  • SHA1

    cf0589c32b4d18303e194672a7710fd6a9a655d6

  • SHA256

    47f84419a3c49e289492b9e348c14c268b117cd26964746fa65318c893cbe81f

  • SHA512

    b3d45c54a9280534ea6471f252635f5cc04cb8a95f70d87041af24033f21db332184eaba72149c29b1028ba8d84fdfe0b54c46dd91952ca930bebb2a297c22dd

  • SSDEEP

    12288:nZ+pDu9YrDQKiXEfiVzhY1Iys0P9ckXgeteabKSctHSoHJD4XWdFvn:n80sDNiUfiPgI91kXgeYEF2HSoHYCFf

  Score

  9^/10

  defense_evasiondiscoveryevasionexecutionimpactpersistenceransomwaretrojan

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral5behavioral6

• • Target

    Rack/5578d702c7fd246e11f71c4edb27b316ca267c6161effab324c9f6e6260bc9e5

  • Size

    193KB

  • MD5

    30e0b36b2d521349158517b34d4acd78

  • SHA1

    cd42b3395aa69071e9b60bd6760c356ec91478ee

  • SHA256

    5578d702c7fd246e11f71c4edb27b316ca267c6161effab324c9f6e6260bc9e5

  • SHA512

    ead402fd51d9438d94019d5311e6a82b550e436a30df107a5d78b3a83ef89730a9250c8f5b1f5ba1e77373d94cc8d432ffa3f5d9e3ebb2c813dcb8e1be552722

  • SSDEEP

    3072:9DsjAbUHwEHnhP3UL9QPbOSp6KgT2vGagCJK51YinXp:9DmAAHtx3UL9+bOVKqCJK5mi5

  Score

  9^/10

  defense_evasiondiscoveryevasionexecutionimpactpersistenceransomwaretrojan

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral7behavioral8

• • Target

    Rack/5606ce60e5b92f774579a2e60d76a1eaccbf946df8bd5fe828ef343856b7af56

  • Size

    1.1MB

  • MD5

    e3aa99937965b8f10885803153373540

  • SHA1

    6b12def96c216fc6acb1f240a38693f6531b5bdf

  • SHA256

    5606ce60e5b92f774579a2e60d76a1eaccbf946df8bd5fe828ef343856b7af56

  • SHA512

    39179217d54f50437e3cf6b3278f2c74f20e9bf2ff0797561f0551a424fc627849466f0c4c4789b3f470e4eea3c8a195ff5f5372a61b1e7711d4af588b7319a7

  • SSDEEP

    12288:eW+pDu9YrDQKiXEfiVzhY1Iys0P9ckMveteJCfol1cUX9NqnQaCfol1cUX9NqnQj:eb0sDNiUfiPgI91kMveYvfgnQ8fgnQj

  Score

  1^/10
  behavioral10behavioral9

• • Target

    Rack/6235491cac4d58eb04c20f1649de6b3381972cdd33158b797fa6f6845afcd2c9

  • Size

    96KB

  • MD5

    833a318c7e39fff973bc37a66715b452

  • SHA1

    e5d5539eb70c8a23cb115dd042fb3693a775cbba

  • SHA256

    6235491cac4d58eb04c20f1649de6b3381972cdd33158b797fa6f6845afcd2c9

  • SHA512

    821c8bfd341bc2f5d83f66e9e5844b6ebd5ab0dd633bc0a1fddfba079831485f4f7507e8abeabb9265199a9a959b1dd0299a5bb1bee09780386aade6e6efde94

  • SSDEEP

    1536:akH/EAQ3tLLXfHY1P6I/v5zKdNm/UhVqLas/OFgnND:aBAQ3hfCP6Y52g/UhVqOeOGnND

  Score

  10^/10

  discoveryevasionpersistencetrojan

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • UAC bypass

    evasiontrojan

  • Adds policy Run key to start application

    persistence

  • Disables taskbar notifications via registry modification

    evasion

  • Deletes itself

  • Blocklisted process makes network request

  • Suspicious use of SetThreadContext

  behavioral11behavioral12

• • Target

    Rack/666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6

  • Size

    323KB

  • MD5

    dfe0390e501faf0de5ba5093304e8ac2

  • SHA1

    266ca584a811b8ccd4d513a0b007d206575a60a9

  • SHA256

    666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6

  • SHA512

    0423b083ada2a6c201cf777d14e74e73d9484c9f34f8681e86e4265e80ee50a5c454c55c5d6e9dbc858abeb97c28bd51d44fe4dd113a7a54ebe6a15241de7373

  • SSDEEP

    6144:7/nQNudGK9+oNitAoYdbmTE/T69Jozt6RshzlaydO5YtPIrm:7/nqudGPoNitvyaQm90tJJ/aYD

  Score

  10^/10

  dharmacredential_accessdefense_evasiondiscoveryexecutionimpactpersistenceransomwarespywarestealer

  • Dharma

    Dharma is a ransomware that uses security software installation to hide malicious activities.

    ransomwaredharma

  • Dharma family

    dharma

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Renames multiple (315) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Drops startup file

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  behavioral13behavioral14

• • Target

    Rack/6a08b51e02a7b510972907c326041222ff4632ba53b89573fca7e80b59c4e168

  • Size

    260KB

  • MD5

    1603aa73ddc1b52002505f49f4680ae0

  • SHA1

    82bea2f53c75ff446723bf2842fa357c3b0fe0ce

  • SHA256

    6a08b51e02a7b510972907c326041222ff4632ba53b89573fca7e80b59c4e168

  • SHA512

    39f49d626c38be26d413570e490998f62d769badacb872dce295657dbbd9cb3690d9324f26b59e377c4be1716ec34d2e3e4f8d3586078432b18b2f3178a34511

  • SSDEEP

    6144:CkMYmk7nSPwZCNnRFujfLRvhgmvH/VCrEfEa:CkMdkDSPlfFurLdfVCPa

  Score

  5^/10

  discovery

  • Suspicious use of SetThreadContext

  behavioral15behavioral16

• • Target

    Rack/73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e

  • Size

    271KB

  • MD5

    9edb93f2c5f92e7b1a664c266347ad0b

  • SHA1

    f50e7db97b67da6686ec113d3d7a82aac1c647b4

  • SHA256

    73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e

  • SHA512

    437afb8757696a05165c0df8a3c99e22ba9c9d213ad03a8f9153562669abb42cb9e57e15907073e2a3d7f0e4f3d3ff6ca7fe16bf2168c3f1b36993849b2d09d0

  • SSDEEP

    6144:v0OiXvUOgT5UIp9+QF+wGonORR77vF70q2T:FifIpFiALT

  Score

  10^/10

  dharmacredential_accessdefense_evasiondiscoveryexecutionimpactpersistenceransomwarespywarestealer

  • Dharma

    Dharma is a ransomware that uses security software installation to hide malicious activities.

    ransomwaredharma

  • Dharma family

    dharma

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Renames multiple (310) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Drops startup file

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  behavioral17behavioral18

• • Target

    Rack/849ebe96bbc8cb10dc7f980e272aea06dbedc66d7228ff1333542a7ff6aa017c

  • Size

    780KB

  • MD5

    d520ef5be51361f876dbf984a91e5970

  • SHA1

    65d1a0ca4e357c6ef7972a6375bcfdb671919d87

  • SHA256

    849ebe96bbc8cb10dc7f980e272aea06dbedc66d7228ff1333542a7ff6aa017c

  • SHA512

    87046be05704b4cbc3ed9445a3aa41730d3cec03f238d4641785ed26a14f1cd2a910b64b7bd619880b2f9f3f678c818b28211fcdbc799c2df5807b3e4516d2a7

  • SSDEEP

    12288:4W+pDu9YrDQKiXEfiVzhY1Iys0P9ckMveteJCfol1cUX9NqnQ:4b0sDNiUfiPgI91kMveYvfgnQ

  Score

  1^/10
  behavioral19behavioral20

• • Target

    Rack/8afc51fb904b25124bd5cb41985e917333071d1af1c6ab83cc7ae408e7cb0e7e

  • Size

    765KB

  • MD5

    54a6d762039fd77d11669ca5ee10f56f

  • SHA1

    3f2b17cbe9a5291d8f14f9359113bf7f59ea13ba

  • SHA256

    8afc51fb904b25124bd5cb41985e917333071d1af1c6ab83cc7ae408e7cb0e7e

  • SHA512

    44fe379e68cdbac584d33589859ca65791640e1a013dbc92bb770ede63f95841ddb2e76f7616f2736417c8b8ad040ce3cebbd669882a7e88a1e1c09d65f789de

  • SSDEEP

    12288:oV+pDu9YrDQKiXEfiVzhY1Iys0P9ck4gete0bKSctHSoHvVn6eVijzFME4fmUReH:oI0sDNiUfiPgI91k4geY2F2HSoHvB6cs

  Score

  9^/10

  defense_evasiondiscoveryevasionexecutionimpactpersistenceransomwaretrojan

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral21behavioral22

• • Target

    Rack/d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191

  • Size

    304KB

  • MD5

    19e48e72c51e0e652a2b5c75db0ef9bc

  • SHA1

    b4ea00205b0e611e2fc155d5ded19b22cd6341f3

  • SHA256

    d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191

  • SHA512

    65269d693b7ddf70c76069d2a80cec73ba1f78a38b0cfcf029af5c30eca972a7b2f21c327f63ac5a17d85a7fab4008e4c04d6ba4e50561f2f71ea7ede52175e2

  • SSDEEP

    6144:6V13slAMd1EHcabi6NiwnpmxKFGgTU55MlP:6VxZM3raLdnAKFGg4HMx

  Score

  10^/10

  dharmacredential_accessdefense_evasiondiscoveryexecutionimpactpersistenceransomwarespywarestealer

  • Dharma

    Dharma is a ransomware that uses security software installation to hide malicious activities.

    ransomwaredharma

  • Dharma family

    dharma

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Renames multiple (319) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Drops startup file

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  behavioral23behavioral24

• • Target

    Rack/e4ea72a1de2c5e1388cb35eee6beffdae4e06f9fe08f9aca04ad6350e32e338a

  • Size

    468KB

  • MD5

    48e5a248e84d3f9ca932c3d2aeee820b

  • SHA1

    faf92d3340613a28c16e09a333bfbc51637bb7be

  • SHA256

    e4ea72a1de2c5e1388cb35eee6beffdae4e06f9fe08f9aca04ad6350e32e338a

  • SHA512

    571b92d2309fe3e4ecb9d1a85d45d631b7384fcc8051ca3100f1e6fd0d3cda4de71381f366b248ed2959c304152c2664382f1f6506f613fa08981a198ed9bd7e

  • SSDEEP

    12288:l6UZbz+f5GEfSxPblS876KWMor1jRehXBrcKwyYh:bhz+1f+UhCX12

  Score

  9^/10

  defense_evasiondiscoveryevasionexecutionimpactpersistenceransomwaretrojan

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral25behavioral26

• • Target

    Rack/e58768c3df867270aa9e3177709415005914b39d272623e8d296106ad5cf125c

  • Size

    773KB

  • MD5

    48fc525c80aea2a073b4e16f4a98646b

  • SHA1

    aac1555af284530a0072a0a4caa8e55231f35427

  • SHA256

    e58768c3df867270aa9e3177709415005914b39d272623e8d296106ad5cf125c

  • SHA512

    8baecb449ecb48431cd5cfaf4d3b5b22b4e4f13e4b0d98fef74fa8e3149c6c737214c23b21ff69290ac5bdc90f0905e221c9fe43d32b3cf378e057e807c8bd71

  • SSDEEP

    24576:DI0sDNiUfiPgI91k4geYZF2HSoHvwA6PfRAcOsA0:Dq5iUU5nSeYiHSoH94fK0

  Score

  9^/10

  defense_evasiondiscoveryevasionexecutionimpactpersistenceransomwaretrojan

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral27behavioral28

• • Target

    Rack/e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d

  • Size

    300KB

  • MD5

    26bf7c2ab048094e9a0c15368d1105ba

  • SHA1

    b0946dd6abcab1fddc71e2308ffb4587e094b03d

  • SHA256

    e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d

  • SHA512

    437746ac926442d99cd9fa1164749a7a798be780e21ef42d14b4cb55ff8109eae296da5d74df924bc78c8ce2dc78b867dde032c297461dbebb4df2f728e6148f

  • SSDEEP

    6144:T6ckSlQncoC4x/B5eRc6w/QPgDEC0NpW6AvJF55yFW6:T6RPncohxf/YqECCzMRm

  Score

  10^/10

  dharmacredential_accessdefense_evasiondiscoveryexecutionimpactpersistenceransomwarespywarestealer

  • Dharma

    Dharma is a ransomware that uses security software installation to hide malicious activities.

    ransomwaredharma

  • Dharma family

    dharma

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Renames multiple (316) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Drops startup file

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  behavioral29behavioral30

• • Target

    Rack/fc330047cbdd7edc5776a5ef560e9ca73f3986ccd17f0e775a57b563dd8a2cdd

  • Size

    248KB

  • MD5

    684b51ea1c9252e13066d7fe9d0cecd0

  • SHA1

    f0db492b67f4b46c63db6afaa59a2d33848c4e4b

  • SHA256

    fc330047cbdd7edc5776a5ef560e9ca73f3986ccd17f0e775a57b563dd8a2cdd

  • SHA512

    2afbd8225998bd2f54d3cb9dbebe3e61767a90ac1be0c00c917d6011013e3fb6eb014b47f3df3ca48e0af74a8c4b801d13eb8ca70873ff2dbf7aefa38b2bc25d

  • SSDEEP

    3072:c49kOnGapJGUghQdP984U9k4UQ8l9xTd36oujT9k6G:c49kQzJGUd9fU18l7Td3rujT9k

  Score

  9^/10

  defense_evasiondiscoveryevasionexecutionimpactpersistenceransomwaretrojan

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral31behavioral32