dharma

General

Target

2025-03-12_7e030a721c095a68123d26fb92c70ea8_dharma
Size

92KB
Sample

250312-nqgaeszrt5
MD5

7e030a721c095a68123d26fb92c70ea8
SHA1

22a89ac8d08b7ff16b2eaf794a6f47007177a1d3
SHA256

4c78ef8799f4f76d29d2867a67f91ea8b31c2105913ad63f69be40c5eceb8fe5
SHA512

67e251cbc8e0a78a2e403fd950401f155700ad2f9fbcf4955bc88a0f7c19b022a6328a9bb7dbcabd69f721331c16094b8568e911074c87239f881e1c46a9ab03
SSDEEP

1536:QBwl+aX5s69pPlwm4yxY9S4AmB2/2T1ZqJQ4wDrObcO57jfA3Q:aQ+qs69pamfxLIxPKuvObJMQ

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta

Ransom Note

YOUR FILES ARE ENCRYPTED Don't worry,you can return all your files! If you want to restore them, follow this link: email [email protected] YOUR ID If you have not been answered via the link within 12 hours, write to us by e-mail: [email protected] Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Emails

[email protected]

Targets

- Target
  
  2025-03-12_7e030a721c095a68123d26fb92c70ea8_dharma
- Size
  
  92KB
- MD5
  
  7e030a721c095a68123d26fb92c70ea8
- SHA1
  
  22a89ac8d08b7ff16b2eaf794a6f47007177a1d3
- SHA256
  
  4c78ef8799f4f76d29d2867a67f91ea8b31c2105913ad63f69be40c5eceb8fe5
- SHA512
  
  67e251cbc8e0a78a2e403fd950401f155700ad2f9fbcf4955bc88a0f7c19b022a6328a9bb7dbcabd69f721331c16094b8568e911074c87239f881e1c46a9ab03
- SSDEEP
  
  1536:QBwl+aX5s69pPlwm4yxY9S4AmB2/2T1ZqJQ4wDrObcO57jfA3Q:aQ+qs69pamfxLIxPKuvObJMQ
Score

10^/10

dharma credential_access defense_evasion discovery execution impact persistence ransomware spyware stealer
- Dharma
  Dharma is a ransomware that uses security software installation to hide malicious activities.
  ransomware dharma
- Dharma family
  dharma
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Renames multiple (322) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Drops file in System32 directory
behavioral1 behavioral2