dharma | 48f6ce1fc9ba2409e876f8d075bddf76ba1576433558ab3733914a9600b5f1d8

General

Target
2026-10-15_9ad96acb6fd24d7cb641253580a99bc6_coinminer_crysis_dharma_elex
Size 92KB
Sample261016-llk2pswt9k
SHA256 48f6ce1fc9ba2409e876f8d075bddf76ba1576433558ab3733914a9600b5f1d8
MD5 9ad96acb6fd24d7cb641253580a99bc6
SHA1 258d9133ad4dfc0d2bd8c381cf056b167d6ca55c
SHA512 4b9b5f483b2eb4d722f7e509fcd44de823edf5c1d63790c352b79d3d688f9a10d3c2188bae3a213e8e37e0d668c55c4473202f0707acb291cace79987dafe7fe
SSDEEP 1536:mBwl+KXpsqN5vlwWYyhY9S4A2uaZFSjCsrIMEt/AJ+IxQ:Qw+asqN5aW/hLMuaZkjCUIMEt/C
TLSH
T12A939E29D521D039F8A350FFCBF646BDAD645B202307D4D793C01E95A7869E6F832A32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Roaming\Info.hta

Ransom Note

<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01//EN' 'http://www.w3.org/TR/html4/strict.dtd'> <html> <head> <meta charset='UTF-8'> <title>[email protected]</title> <HTA:APPLICATION ICON='msiexec.exe' SINGLEINSTANCE='yes' SysMenu="no"> <script language='JScript'> window.moveTo(50, 50); window.resizeTo(screen.width - 100, screen.height - 100); </script> <style type='text/css'> body {font:15px Tahoma;margin:10px;line-height:20px;background:#FFFFF0;color:#000000} .bold {font-weight:bold;} .mark {color:#000000;padding:8px 10px;} img {display:block;margin:auto;} .header {text-align:center;font-size:30px;line-height:75px;font-weight:bold;margin-bottom:20px;} .info {background:#c0c2bc;border-left:10px solid #FFE4E4;} .alert {background:#008080;border-left:40px solid #FF4500;} .private {border:5px dashed #000000;background:#000FEF;} .note {height:auto;padding-bottom:5px;margin:15px 0;} .note .title {font-weight:bold;text-indent:10px;height:30px;line-height:30px;padding-top:10px;} .note .mark {background:#A2A2B5;} .note ul {margin-top:0;} .note pre {margin-left:15px;line-height:13px;font-size:13px;}</style> </head> <body> <div class='header'> <img src='data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAEAAAABACAQAAAAAYLlVAAAABGdBTUEAALGPC/xhBQAAACBjSFJNAAB6JQAAgIMAAPn/AACA6QAAdTAAAOpgAAA6mAAAF2+SX8VGAAAAAmJLR0QA/4ePzL8AAAAJcEhZcwAACxMAAAsTAQCanBgAAAAHdElNRQfjAwwMJwSFwIn8AAADNklEQVRo3u2ZTUhUURTHfzozmprmZ1pYEmkfJNEmiwwkSEyFECIQpEUboYhqFYHQXlcti9rUKldWBEUiuQpbtDDNzD5G8qM0HRXLRtO5LdJx3puPd++8+xyIztm88zgf/3veufeee18SdimDI1RxnL0U4gbAzxhDdPGCfpZs+49JWTTyFB8iAq8wTju1pDgXvopOliIGX+d57rHPieBuLvLNIvgaD1KvP/x1FiTDCwQTNOkFcJVfCuEFgq+c0he+minF8AJBH2WRnCUph8/nIZVhb2d5w1smEbjYSTn7SQ/TucsFlnWkPxBW6Xc4RkbIoHKooSNshsxRbT98Eb0mtyM04oqgmR6hUNvtrwrnWDa4nOVMVF0XLfw2aPuosBfezQPTmNpiVtFmnpj0W+wBKMFrcPeJ3RYWNfwwWHSSZgdAHX6Du5uWFpl0myqm1KiQrASgnNQQaZFOS4t5nhvkAnbZAbDHIE0wIGHzmsUQKdXkQwlACtsN8ijfJay8zBjkovgBbCLPlAG/hNUcswa5IH4Ayasdzxr5pBbWRRYMstGHYg04QAkH4FbQFSwTCKbdI7mzWVipbMceKtiCCFqO0OeY1caRbAaKOcgOCpQ+WWTyM8EwvfjkTfJoYZDFONqwaPyTHs7LbktlPNMYep2XuE22dfhsHjkS/i+3Wn/SK2EdoE72UeuyGH8rxbbLLjqlkRlb4TAzDo5fIJiOvRTnR+ju9VJuwveC/wASDsD+2h5KUyyQTVZiALzjFt3MsY16mtmqx2mt9BbUw4EQuzpGpVcCLQB8nDBZXmJFDoCeInzFS9ObxwzLmeoBMGA4/QBM4t1IAOHXDi7Zqwg9ACrCWotS8xnQWQCHOGsafzOFOhzLT8NxmoI3RZncULjG1ARA8DHYupxUucbUtxd4ghnw4JI30wdARHneMABx0j8FYD3xCkdefQByKFl9KsOjy6nKNBR0cZRCTjOk1JhrBCCY5r3pZtSS9bZkueSqmljVgPoPDa0Algk4HD8QG8AXph0G8Dk2AC89DgPosFKodvR83G/dtiRzTevtUChP0SCTpBQuM+bI6Bvk51gl96X/FFvzCh9oW0v+H2zO2tYtz/EgAAAAJXRFWHRkYXRlOmNyZWF0ZQAyMDE5LTAzLTEyVDEyOjM5OjA0KzAwOjAwG6lIYwAAACV0RVh0ZGF0ZTptb2RpZnkAMjAxOS0wMy0xMlQxMjozOTowNCswMDowMGr08N8AAAAASUVORK5CYII='> <div>All your files has been encrypted!</div> </div> <div class='bold'>Don't worry, you can return all your files!</span></div> <div class='bold'>If you want to restore them, contact us:<span class='mark'> [email protected] </span> YOUR ID <body bgcolor=#00FFFF> <font color=#000000>DB5CA820</font></div> <div class='bold'> <body> If you have not answered by mail within 12 hours, contact mail:<span class='mark'>[email protected]</span></div> <div class='note info'> <div class='title'>Free decryption as guarantee</div> <ul>Before paying you can send us up to 3 files for free decryption. </ul> <ul>The total size of files must be less than 3Mb (non archived), files should not contain valuable information. (databases,backups, large excel sheets, etc.)</ul> </div> <div class='note info'> <div class='title'>Some of your data has been downloaded</div> <ul> <br>In case if you refuse to cooperate all downloaded data will be transfered to third parties.</ul> <ul>Financial implications: The threat of data breach could result in significant fines and legal action.</ul> <ul>Reputational risks: Data breach may lead to a loss of trust from customers and partners, as well as negative consequences for your future work.</ul> <ul>We strongly recommend you to contact us directly, to avoid the extra fee from middlemans and lower the risks of scam.</ul> <br><a href=</a> </ul> </div> <div class='note alert'> <div class='title'>Attention!</div> <ul>Do not rename encrypted files.</ul> <ul>Do not try to decrypt your data using third party software, it may cause permanent data loss.</ul> <ul>Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.</ul> </div> </body>

Emails

<title>[email protected]</title>
[email protected]
class='mark'>[email protected]</span></div>

URLs

http://www.w3.org/TR/html4/strict.dtd'>

Extracted

Path

C:\Windows\System32\Info.hta

Ransom Note

<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01//EN' 'http://www.w3.org/TR/html4/strict.dtd'> <html> <head> <meta charset='UTF-8'> <title>[email protected]</title> <HTA:APPLICATION ICON='msiexec.exe' SINGLEINSTANCE='yes' SysMenu="no"> <script language='JScript'> window.moveTo(50, 50); window.resizeTo(screen.width - 100, screen.height - 100); </script> <style type='text/css'> body {font:15px Tahoma;margin:10px;line-height:20px;background:#FFFFF0;color:#000000} .bold {font-weight:bold;} .mark {color:#000000;padding:8px 10px;} img {display:block;margin:auto;} .header {text-align:center;font-size:30px;line-height:75px;font-weight:bold;margin-bottom:20px;} .info {background:#c0c2bc;border-left:10px solid #FFE4E4;} .alert {background:#008080;border-left:40px solid #FF4500;} .private {border:5px dashed #000000;background:#000FEF;} .note {height:auto;padding-bottom:5px;margin:15px 0;} .note .title {font-weight:bold;text-indent:10px;height:30px;line-height:30px;padding-top:10px;} .note .mark {background:#A2A2B5;} .note ul {margin-top:0;} .note pre {margin-left:15px;line-height:13px;font-size:13px;}</style> </head> <body> <div class='header'> <img src='data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAEAAAABACAQAAAAAYLlVAAAABGdBTUEAALGPC/xhBQAAACBjSFJNAAB6JQAAgIMAAPn/AACA6QAAdTAAAOpgAAA6mAAAF2+SX8VGAAAAAmJLR0QA/4ePzL8AAAAJcEhZcwAACxMAAAsTAQCanBgAAAAHdElNRQfjAwwMJwSFwIn8AAADNklEQVRo3u2ZTUhUURTHfzozmprmZ1pYEmkfJNEmiwwkSEyFECIQpEUboYhqFYHQXlcti9rUKldWBEUiuQpbtDDNzD5G8qM0HRXLRtO5LdJx3puPd++8+xyIztm88zgf/3veufeee18SdimDI1RxnL0U4gbAzxhDdPGCfpZs+49JWTTyFB8iAq8wTju1pDgXvopOliIGX+d57rHPieBuLvLNIvgaD1KvP/x1FiTDCwQTNOkFcJVfCuEFgq+c0he+minF8AJBH2WRnCUph8/nIZVhb2d5w1smEbjYSTn7SQ/TucsFlnWkPxBW6Xc4RkbIoHKooSNshsxRbT98Eb0mtyM04oqgmR6hUNvtrwrnWDa4nOVMVF0XLfw2aPuosBfezQPTmNpiVtFmnpj0W+wBKMFrcPeJ3RYWNfwwWHSSZgdAHX6Du5uWFpl0myqm1KiQrASgnNQQaZFOS4t5nhvkAnbZAbDHIE0wIGHzmsUQKdXkQwlACtsN8ijfJay8zBjkovgBbCLPlAG/hNUcswa5IH4Ayasdzxr5pBbWRRYMstGHYg04QAkH4FbQFSwTCKbdI7mzWVipbMceKtiCCFqO0OeY1caRbAaKOcgOCpQ+WWTyM8EwvfjkTfJoYZDFONqwaPyTHs7LbktlPNMYep2XuE22dfhsHjkS/i+3Wn/SK2EdoE72UeuyGH8rxbbLLjqlkRlb4TAzDo5fIJiOvRTnR+ju9VJuwveC/wASDsD+2h5KUyyQTVZiALzjFt3MsY16mtmqx2mt9BbUw4EQuzpGpVcCLQB8nDBZXmJFDoCeInzFS9ObxwzLmeoBMGA4/QBM4t1IAOHXDi7Zqwg9ACrCWotS8xnQWQCHOGsafzOFOhzLT8NxmoI3RZncULjG1ARA8DHYupxUucbUtxd4ghnw4JI30wdARHneMABx0j8FYD3xCkdefQByKFl9KsOjy6nKNBR0cZRCTjOk1JhrBCCY5r3pZtSS9bZkueSqmljVgPoPDa0Algk4HD8QG8AXph0G8Dk2AC89DgPosFKodvR83G/dtiRzTevtUChP0SCTpBQuM+bI6Bvk51gl96X/FFvzCh9oW0v+H2zO2tYtz/EgAAAAJXRFWHRkYXRlOmNyZWF0ZQAyMDE5LTAzLTEyVDEyOjM5OjA0KzAwOjAwG6lIYwAAACV0RVh0ZGF0ZTptb2RpZnkAMjAxOS0wMy0xMlQxMjozOTowNCswMDowMGr08N8AAAAASUVORK5CYII='> <div>All your files has been encrypted!</div> </div> <div class='bold'>Don't worry, you can return all your files!</span></div> <div class='bold'>If you want to restore them, contact us:<span class='mark'> [email protected] </span> YOUR ID <body bgcolor=#00FFFF> <font color=#000000>0B1A65C9</font></div> <div class='bold'> <body> If you have not answered by mail within 12 hours, contact mail:<span class='mark'>[email protected]</span></div> <div class='note info'> <div class='title'>Free decryption as guarantee</div> <ul>Before paying you can send us up to 3 files for free decryption. </ul> <ul>The total size of files must be less than 3Mb (non archived), files should not contain valuable information. (databases,backups, large excel sheets, etc.)</ul> </div> <div class='note info'> <div class='title'>Some of your data has been downloaded</div> <ul> <br>In case if you refuse to cooperate all downloaded data will be transfered to third parties.</ul> <ul>Financial implications: The threat of data breach could result in significant fines and legal action.</ul> <ul>Reputational risks: Data breach may lead to a loss of trust from customers and partners, as well as negative consequences for your future work.</ul> <ul>We strongly recommend you to contact us directly, to avoid the extra fee from middlemans and lower the risks of scam.</ul> <br><a href=</a> </ul> </div> <div class='note alert'> <div class='title'>Attention!</div> <ul>Do not rename encrypted files.</ul> <ul>Do not try to decrypt your data using third party software, it may cause permanent data loss.</ul> <ul>Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.</ul> </div> </body>

Emails

<title>[email protected]</title>
[email protected]
class='mark'>[email protected]</span></div>

URLs

http://www.w3.org/TR/html4/strict.dtd'>

Targets

- Target
  2026-10-15_9ad96acb6fd24d7cb641253580a99bc6_coinminer_crysis_dharma_elex
- Size 92KB
- SHA256 48f6ce1fc9ba2409e876f8d075bddf76ba1576433558ab3733914a9600b5f1d8
- MD5 9ad96acb6fd24d7cb641253580a99bc6
- SHA1 258d9133ad4dfc0d2bd8c381cf056b167d6ca55c
- SHA512 4b9b5f483b2eb4d722f7e509fcd44de823edf5c1d63790c352b79d3d688f9a10d3c2188bae3a213e8e37e0d668c55c4473202f0707acb291cace79987dafe7fe
- SSDEEP 1536:mBwl+KXpsqN5vlwWYyhY9S4A2uaZFSjCsrIMEt/AJ+IxQ:Qw+asqN5aW/hLMuaZkjCUIMEt/C
- TLSH
  T12A939E29D521D039F8A350FFCBF646BDAD645B202307D4D793C01E95A7869E6F832A32
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access defense_evasion discovery execution dharma impact persistence privilege_escalation ransomware spyware stealer
- Family: Dharma
  Dharma is a ransomware that uses security software installation to hide malicious activities.
  ransomware dharma
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Detects win.dharma.
- Identifies DHARMA ransomware
- Renames multiple (813) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Drops file in System32 directory
behavioral1 behavioral2