Extracted

• • Target

    2025-02-27_a43619354027879e0dae80878636389f_dharma_ramnit

  • Size

    201KB

  • MD5

    a43619354027879e0dae80878636389f

  • SHA1

    bc7ce81b1388890a697a7480941e1659264fa462

  • SHA256

    104b4ec8a7c39ba5f87be908d86a5e4f34fce70e5ae4992f8435837c2d8fb448

  • SHA512

    7ea3706cb447c96c040dd397ede4c5047895a69639cd6b8524434ff71b9e0cbeb61563f0d80b464ffe0cb6088e54b618cbfbb0be50e841003aae88f0dbfb9c92

  • SSDEEP

    6144:yw+E6shLwFZBh/kFdMyJeGbfUTpYDDmu/+3fbe:ycIZCdMy8G+pG/Ye

  Score

  10^/10

  dharmaramnitbankercredential_accessdefense_evasiondiscoveryexecutionimpactpersistenceransomwarespywarestealertrojanupxworm

  • Dharma

    Dharma is a ransomware that uses security software installation to hide malicious activities.

    ransomwaredharma

  • Dharma family

    dharma

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

    trojanspywarestealerwormbankerramnit

  • Ramnit family

    ramnit

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Renames multiple (311) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2