dharma | 762a1cf7b64b1f415036e4f945614ff74a70315071bc8e4e7e5f60d4b351ab65

Resubmissions

30/04/2026, 18:28

260430-w4my5acx3j3

19/04/2026, 06:51

260419-hmrdbsdz5r10

19/04/2026, 03:57

260419-ejblxscs8j10

Sharing

Copy URL Twitter E-mail

General

Target
Athrun is asutistic.zip
Size 287KB
Sample260419-ejblxscs8j
SHA256 762a1cf7b64b1f415036e4f945614ff74a70315071bc8e4e7e5f60d4b351ab65
MD5 1edecf8c9ecdd3927647c23840af0e5d
SHA1 d233748d272463a12811933b647e88342ec3b2ec
SHA512 ad51737be57c9625784422799f237c176498a87822d1457cfc228da28716cab27d2e756e31349373fbb4cb3ff440ed50de6d4df845a4a96d402308c69a85e312
SSDEEP 6144:4EWVK7JGG/dspwzL+eECSVtJCtBSdL22XIOf/DEqHeNg/yxYvUefkDZ6QZYczDSJ:4E37JGG/dspwzBECSVtktBSdL22XIOfv
TLSH
T150547D21C9EDD922DC2B077DD66612667DD20BC6FA36761733CA0C11681A8DE0BD93BC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Athrun is asutistic.zip
- Size 287KB
- SHA256 762a1cf7b64b1f415036e4f945614ff74a70315071bc8e4e7e5f60d4b351ab65
- MD5 1edecf8c9ecdd3927647c23840af0e5d
- SHA1 d233748d272463a12811933b647e88342ec3b2ec
- SHA512 ad51737be57c9625784422799f237c176498a87822d1457cfc228da28716cab27d2e756e31349373fbb4cb3ff440ed50de6d4df845a4a96d402308c69a85e312
- SSDEEP 6144:4EWVK7JGG/dspwzL+eECSVtJCtBSdL22XIOf/DEqHeNg/yxYvUefkDZ6QZYczDSJ:4E37JGG/dspwzBECSVtktBSdL22XIOfv
- TLSH
  T150547D21C9EDD922DC2B077DD66612667DD20BC6FA36761733CA0C11681A8DE0BD93BC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware credential_access defense_evasion discovery execution dharma impact persistence ransomware spyware stealer trojan upx
- Family: Dharma
  Dharma is a ransomware that uses security software installation to hide malicious activities.
  ransomware dharma
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Renames multiple (801) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Disables Task Manager via registry modification
  defense_evasion
- Downloads MZ/PE file
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Deletes itself
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  defense_evasion trojan
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops desktop.ini file(s)
- ConfuserEx .NET packer
  Detects ConfuserEx .NET packer.
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1
- Target
  modlist.html
- Size 6KB
- SHA256 4b7fd1f8ad4ef6e6156f16de80d6b4c079dff65223280ca0d3a16699e2f23a6a
- MD5 51114533ad419537931f1ee6b6006a48
- SHA1 7ab59f087861fd385c2967fac3090d06998a063a
- SHA512 4291214be13c3451213f477f166e51bb33f116f98c8c117c0a0be7d49aa5e0655f8dc351c796bd260d026fa53dca465b53961ff8d44ae6db75fbb21653e60009
- SSDEEP 192:GjKDt9PR7V/hGEla4s+sZSKujw497X4FSpykxV+ExBO/3rVUhgaqLLcWj39Q/Pkq:ltjeTWoMWW
- TLSH
  T1FBD108B799AEB9167B6ED1BDA0303B1DC52391E75A094AE7B0A24C477BC01D308146AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral2
- Target
  overrides/mods/documentation/palladium/abilities.html
- Size 311KB
- SHA256 91fc046727eb3c87156614103d7184c61c8563b990363bcaa0f9b9778632b042
- MD5 dceef9eb08cff9ef1298a70669fc8c25
- SHA1 fe8f04629df9926f631160cddc1fcc62555ce395
- SHA512 a5540eebd312d24ac260139d42d22b9b904e2a60aa0becb312685711a985fe9db06c3b2e456c6f26f5a479fc214d1465b317db52bf061085f400fea4465ed772
- SSDEEP 1536:qqM319/b+u1e9Vys+FZH0T212E4PBfzShaJl1sUm/B8I2OnPU5rmVxcb6cvPXP95:fM0yLfQ
- TLSH
  T10464BB14E0C526BEA4660173DC7C8E9487F8C070C7905AA5CB2FDE7F73446F46A6B29A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Loads dropped DLL
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3
- Target
  overrides/mods/documentation/palladium/accessories.html
- Size 10KB
- SHA256 5547060db0995203e656a06bfce6762a8fac79bc454d9d5c1953a730b3bc03df
- MD5 2d786000468d62d2516d73f9d681e6b9
- SHA1 17e6d4e16e29da120f21e1580ea9a51ed88fa7a0
- SHA512 23c36e4c04ece8e2c4803a45c1f4d04d8ab0df6713f181e52dde7ce216c4c77c8bf6c4a9fa75f9e055f230f91bbb2a82f6e712720fd060cc77fcace71327f602
- SSDEEP 192:evQNbNAXkTrA9XkTuSR7RpXkTPRSK7RpXkTBmL8nJ8uJJVJh:CtXbXBKRpXk1RpXS8uJ3
- TLSH
  T1D1224109A1DA743F6001822A9D2CAC1417F6002183395AA1F76FEE7FBB4CAF675527C9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral4
- Target
  overrides/mods/documentation/palladium/accessory_slots.html
- Size 3KB
- SHA256 3b241425a8a10ae810c80656ab4f36d8ea3169bcc8380faef062356551364d5b
- MD5 16c0c07599bacd8f59d6c099a67d1107
- SHA1 34653070e0c7e50e3f6e353e7b8a92167c7ec31a
- SHA512 00bdfc2b6aa54094cb245c6134629da16c52fe17ae724f39839b2713fcf819a603eda5263eac8e7ff419bccaa076ef47343766ba2d6c04eb2607c1c8d21d740f
- TLSH
  T16B51680AA5C2207E311751A75CAF5D0861B9802249589B74F7AFA9BDAF80CA03593FD4
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5
- Target
  overrides/mods/documentation/palladium/armor_materials.html
- Size 4KB
- SHA256 29830af609c6fc009fe0714e02c45c9af6c8e760d384b86627a207440d49fdcf
- MD5 f0ec3aa4462ffb226e5414cedb65dae1
- SHA1 2b8ca04f3f44b6e81f094b99ea997ca68ad6ac2a
- SHA512 c8d569671d671bf2fad71fe9f2e01172e334efb595ed95302caf7333b8c1f88795b664466db1da5f1aaae76f39fe232ff48535971f64763b27be3e03c68320cb
- SSDEEP 96:ZvQ1DTMBLotRpvJizBse5Rpv8MqU4vRpvTfSxXRpvbESMmQ2E5dmQWXpTmIf9zyy:ZvQlt8Iv2IQozL8nJ8uJJVJh
- TLSH
  T1B391231698C231BF641750675C7E8D0462F980318A595BB4FBAF6DBE3F80CA02167BE9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral6
- Target
  overrides/mods/documentation/palladium/blocks.html
- Size 8KB
- SHA256 f6ee6d59e0f020e684d1673cdafa08d13082f7856dab23209f4f9d3481a4b79b
- MD5 b762162e289862983b2b7eaa22f3089c
- SHA1 4566aa8e651adad78913091e26b5f50c3d8a5c07
- SHA512 a22fcb50e5c5d601dc5045cc9c2ffcf0d2c1f9590d315e07364a71a248ba1d640973c785d785a9be05d5608486aa559ec81881a44d2cfc1cf15a4f0f3a5a3661
- SSDEEP 192:GvQNg2rgxBRg3EQfXObV0SOQ9ZSF5cJZxpL8nJ8uJJVJh:qNvg3EQfebV0pQ9iQi8uJ3
- TLSH
  T18D126204DDA3BB2E309FB026AA356B00F2B9C07F8D1516DCB63F98BA37894D05553693
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral7
- Target
  overrides/mods/documentation/palladium/conditions.html
- Size 71KB
- SHA256 591f26b05b2eba0be0a8ec560ce42dcc5328288631c3566a5582ff0b2785262f
- MD5 7a10628cf3868966aecc078fa38e7b8e
- SHA1 0be843ad05373ca862168d2343354e284c6579b6
- SHA512 13f588153396ee04f8694c3561651c8dfce863c1b79005c0f12f66df1ea5d78d8d24fb294c652b4d23b774691a923763e12ed823f2a7227f9227ac4cd6828862
- SSDEEP 1536:qcFYqcbeuq3E7Wol2R3g0+btTzWxC8uJ3:fFMPqqURebtTz9
- TLSH
  T1D8631F1581C876BF2055422BEE785D9087E5C13087281AB0D73FCD3FB788DE6665B3AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery persistence ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral8
- Target
  overrides/mods/documentation/palladium/creative_mode_tabs.html
- Size 3KB
- SHA256 0eb7f79c755f7e7713008fb4eeb5c6e238f4abbc62db2b242c394f9a0a731344
- MD5 8b775a4407b298b27153b1780711347c
- SHA1 a343b685c18c9bbbd1f0c49bf05703f9d5765ba8
- SHA512 ce86512c43d2f9f6b839bce210b224d63385d7fa5dc12680cf625ef7ca140d2665e64e0212188776cfcf34411e5ae122e5659d865084f032bde4ea9a637933a0
- TLSH
  T1CA516305E4C2207F350B60A71CAF9C0860F9812285559F78F7AFE9BABF508E075A3BD5
- MD5 SHA1 SHA512 TLSH
Score

8^/10

discovery persistence ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral9
- Target
  overrides/mods/documentation/palladium/dynamic_textures/variables.html
- Size 36KB
- SHA256 7572edbb8fa8ef25f34620d392cbfe844afdeca47b470995295a33214f223000
- MD5 984bf6a51e67e3af86cded92ffbda848
- SHA1 ab88fcaf38949644c7939eccc24f5a6a6cb6989c
- SHA512 bbaaea518c6bae8c2e4d5c7a6c11f725122330a2f24a7a9716878ffc72717f88cf49a6370f84919ecae1fcada77cfa6440fe615c26f676178334cd18394f5593
- SSDEEP 192:TvQN4xMuWlC7KUe6jKjN6jazBaN465jWeBaC3lC7K+V8Ni1zmrnPaWUWKIwWa5fI:LDMZB+JrN4DLKmFg8uJ3
- TLSH
  T16B037A08E5CA627EA4550077EC7C8D405BF8417087681AF4EB6FED3F3744CE1AAA6396
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10
- Target
  overrides/mods/documentation/palladium/energy_beam_renderers.html
- Size 7KB
- SHA256 0c18659834d2f6d86d3f67d7d634334b299aeae06698599513ad1064843e89ce
- MD5 490b4a01c8ecac37c06480d76a2232ac
- SHA1 8ba9cdb40183214ae9e9f118e38698f0f0325d16
- SHA512 0ee79ead3419ba2a11e231e6a05847d00cd4ecded3e25b443ccf6ca20e00e99b19664be4458df1d71cb2985a12e9feb701f2535c704df22ad26f83aaf6bfc640
- SSDEEP 192:DvQN6CpxcDzC5WaGY9pxLXDzSKL8nJ8uJJVJh:b5y/il8uJ3
- TLSH
  T185F1B71495C5267FA826007AAC398D5453F8A0B1CB541BA0FB2FEC7F3B058E43A67396
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery persistence ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11
- Target
  overrides/mods/documentation/palladium/icons.html
- Size 6KB
- SHA256 1f5b59a519164f9735dcf99e8ed45268dea0699381e422a47be283281c9416d2
- MD5 617c2ab7c45f1a4d3e39feda1e1d58fa
- SHA1 842ff4a184671fad8b4a29e29825f7a6002e4fad
- SHA512 e77cc6c2c21639b87f917d28368dbd5f6ab942bb8afd432fbea7501d978e8ecb60bcd52732ee201d8f305d2cf8c2d451fe85ddfc77bd7ce353e086a692a29c71
- SSDEEP 192:+vQNj1vpltzt+HnD4wgBLpM4Ns5K8L8nJ8uJJVJh:iIFgJns8uJ3
- TLSH
  T153D12D0484C1317E3506816BAEAC6D00C1F980348628AEB4F7BFD97FFF889E16597799
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral12
- Target
  overrides/mods/documentation/palladium/items.html
- Size 24KB
- SHA256 8ac63e48f152783ecf7bba45dca76e3ee1408fe692e4724d21ffc5556cdecb3f
- MD5 9ed17adb5b4a2855c128233ed3b172f4
- SHA1 15a7bbcfb9eff705357ec10eed8650e0bf3b4000
- SHA512 60741a6ad6700aab7b7ac03865a13da94963f46cb924271e2bdcf94729ceff69b99b77f454d5b1f1cfd425c062cf42784f062d6fba3bfc97384ba8be45e8a801
- SSDEEP 384:8xXZSmORQRL9uheOiAfh4nLEJUCpF4npFK8f8uJ3:8zZOR09uh9iZnLEJtwf8uJ3
- TLSH
  T1EFB20C18C4C6B6BF205651279E785E5092F5C0348B182AF4EB6FDC7F7B848E122A7397
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13
- Target
  overrides/mods/documentation/palladium/tool_tiers.html
- Size 3KB
- SHA256 00589a0a1c0f2084d9fa66798333cd823aa9432a97a95dcfc1540bd17751b21c
- MD5 2accc03c2975979adba4a8d59a9cbae2
- SHA1 f6115193ad76f25f9fecef1446943365b7cb6d2b
- SHA512 beb78f74e75eab2ee75a4fa3e0c619ccdcb513d99cdedc563f8b75a8df8be3d6a5ea2e760d7ad692f591648b787d2ba3f1649bd0a23fa0ccd979cd26120ffab5
- TLSH
  T1D3814505D8D231BE741650669CBE8D0862F9903146185BB8F2EF6DBE6F40CD02497BE5
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral14
- Target
  overrides/mods/documentation/palladium/trails.html
- Size 9KB
- SHA256 491bdd604724214fbf4ac16d3836953e69b8cfbc696785f60d85dbe33cf10089
- MD5 41f2c82a41ab8e55a7af96c9697c61e5
- SHA1 e72a3b28e9d78e85d7be789cb9efcd01ecc455b1
- SHA512 06bbdd753a0d3bb1d379dea96585578048654ece810da69c747856a288116eaa5938c9472715f4f4e2f59a80b24008d6d0d4341101d3d0b27142c3e11171cf19
- SSDEEP 192:NvQNjkD8yLe2aXfNvkTyLeVajfyLvWRCfvHRjCpxLXDzeKL8nJ8uJJVJh:VDw44CBWul8uJ3
- TLSH
  T14712A70495C136BFA4260076AC798E5493F990B487241BB0FB2FDC7F7B458E43A67396
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral15