General
-
Target
8e8b6818423930eea073315743b788aef2f41198961946046b7b89042cb3f95a
-
Size
92KB
-
Sample
200911-5wn2awl2bj
-
MD5
9d919626f55b47d0766c219ba9b57d27
-
SHA1
b58c2abea62887342118970ac4cb791765fd72bd
-
SHA256
8e8b6818423930eea073315743b788aef2f41198961946046b7b89042cb3f95a
-
SHA512
f901ed68683c481e09b5dbd52ed4d81cdac27711d9c104e933dfcb29a2f89a2c59e8f459fbe10df87c7d66356df2c985c727a0de5c64ca83ddf0205593046008
Static task
static1
Behavioral task
behavioral1
Sample
8e8b6818423930eea073315743b788aef2f41198961946046b7b89042cb3f95a.exe
Resource
win7v200722
Behavioral task
behavioral2
Sample
8e8b6818423930eea073315743b788aef2f41198961946046b7b89042cb3f95a.exe
Resource
win10
Malware Config
Extracted
C:\Users\Admin\Desktop\FILES ENCRYPTED.txt
decrypt@europe.com
reservereserv@airmail.com
Extracted
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
decrypt@europe.com
reservereserv@airmail.com
Targets
-
-
Target
8e8b6818423930eea073315743b788aef2f41198961946046b7b89042cb3f95a
-
Size
92KB
-
MD5
9d919626f55b47d0766c219ba9b57d27
-
SHA1
b58c2abea62887342118970ac4cb791765fd72bd
-
SHA256
8e8b6818423930eea073315743b788aef2f41198961946046b7b89042cb3f95a
-
SHA512
f901ed68683c481e09b5dbd52ed4d81cdac27711d9c104e933dfcb29a2f89a2c59e8f459fbe10df87c7d66356df2c985c727a0de5c64ca83ddf0205593046008
Score10/10-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Drops file in System32 directory
-
Modifies service
-