dharma | b5192f9dab520a870acb8e6298dacc6235f532a638851f492fb0d1797cbbb496

General

Target
ic_neurotransmitter.zip
Size 5.6MB
Sample260810-t33xvashrb
SHA256 b5192f9dab520a870acb8e6298dacc6235f532a638851f492fb0d1797cbbb496
MD5 28dead7f80c674342b63f39eefa0302f
SHA1 b4d00b069817e56e1943541a311673357d2d098b
SHA512 3fcda169ca47f4892d4394d2a6b9b0df48efd5af334939067d91d1b858de443116fef62f96cc58d5e46403d2b69a88fdb106c9d8e92ade2b7f31d6a6747d68ae
SSDEEP 98304:wpC+3CKD/uCs3BwXqpeMOitB3rut9mmXbSU3TTrDa/ene6dxg1sRjPTpHUVTQaUQ:gh3CumCs3BT4MDthKmreiJg9TpHbZg00
TLSH
T11E4633E317B9CB6BD56721281CBD12F0A25D5EB0E4A378AD47FDE3013DEA00ADAC5494
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  ic_neurotransmitter/stream/ic_invs_supp_02.ydr
- Size 10KB
- SHA256 308e748b7e0b0c84e1a75e4e002cea75506c46e639b48ba5081301f1d4982c05
- MD5 13460a6892f2f73d8ffb9c578a3615d1
- SHA1 ca03092123d380a2768fd4e4488277f9b19210bf
- SHA512 f8f4af889b3058412f693ffd838d989365a33b894fbce0b532aaab117829f4042163c7ed540243303582f670c101ae00812853900c6a0580139a87503c7deae6
- SSDEEP 192:uJymziucdypW4kWfJ2pPvw8sApZOsI+79/7D950PVJY5AuuRzjCDL9AMjuFKRi6A:uUmNcUZkZI8vZOVS9/770+QYDL91uIVA
- TLSH
  T1B132CF5290C72202C8CBC2B5C5CABDA7948BB9E7889955463DF98D0F00F572468D9D6F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware aspackv2 defense_evasion discovery execution dharma hiddentear spysheriff impact installer persistence privilege_escalation ransomware spyware stealer
- Detects HiddenTear Ransomware
- Detects SpySheriff adware
- Family: Dharma
  Dharma is a ransomware that uses security software installation to hide malicious activities.
  ransomware dharma
- Family: HiddenTear, Cryptear
  HiddenTear aka Cryptear is an open-source ransomware available on Github since 2015, with many versions in the wild.
  ransomware hiddentear
- Family: SpySheriff
  SpySheriff is a Windows adware written in C++.
  adware spysheriff
- Suspicious use of NtCreateProcessExOtherParentProcess
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Renames multiple (74) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Disables Task Manager via registry modification
  defense_evasion
- Downloads MZ/PE file
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
behavioral1